x-frame-bypass icon indicating copy to clipboard operation
x-frame-bypass copied to clipboard

Detection only & open in new tab

Open rotate4all opened this issue 6 years ago • 9 comments
trafficstars

Hi,

I've just found your code and must say this is a very clever solution. However there are some caveats which you should mention like: images, fonts & other external requests won't load.

So I think the best solution would be to simply DETECT if the URL which is restricted from being shown inside iframes, then in the iframe window simply generate a simple button which reads "CLICK HERE TO OPEN IN A NEW TAB" instead of proxying the request.

That would be great as an additional functionality to your class.

rotate4all avatar Jan 08 '19 10:01 rotate4all

Can you give an example URL which cannot load its assets, provided that it starts with https:// (no mixed content)?

niutech avatar Jan 08 '19 13:01 niutech

Sure. Try with https://www.youtube.com

rotate4all avatar Jan 08 '19 14:01 rotate4all

This is due to AJAX in an IFrame being blocked by CORS. It would be necessary to proxy XHR too. Try loading https://www.youtube.com/?disable_polymer=1 instead.

niutech avatar Jan 08 '19 20:01 niutech

Yes, most youtube loads, but not: Bloomberg DW

E3V3A avatar Jan 09 '19 21:01 E3V3A

@niutech What does the disable_polymer do?

E3V3A avatar Jan 10 '19 12:01 E3V3A

@E3V3A As the name shows, it disables the latest redesign using Polymer, which loads web components dynamically. Try appending &disable_polymer=1 for video URLs as well, e.g. https://www.youtube.com/watch?v=dp8PhLsUcFE&disable_polymer=1 or use the embed URLs in regular iframes: https://www.youtube.com/embed/dp8PhLsUcFE

niutech avatar Jan 10 '19 18:01 niutech

@niutech Yeah, I tried that already. Didn't work for the two cases above...

E3V3A avatar Jan 10 '19 19:01 E3V3A

For a single video, a standard iframe should work.

niutech avatar Jan 10 '19 21:01 niutech

Those 2 has iframe disabled, which is why I am here...

E3V3A avatar Jan 11 '19 07:01 E3V3A