1

I am trying to develop a CORS proxy server in Delphi XE2 using Indy 10 so that I can get around the issue of embedding sites into an IFrame where sites have added X-Frame-Options to the response headers.

Can anyone give me some example code as to how I can use IdHTTPProxyServer to do this?

user2365039
  • 11
  • 2
  • "*how I can use IdHTTPProxyServer to do this?*" - To do WHAT, exactly? What exactly do you want to modify? Please be more specific. – Remy Lebeau Jun 02 '21 at 16:25
  • @RemyLebeau From what I understand, the goal is to remove the `X-Frame-Options` header. – Olivier Jun 02 '21 at 17:36
  • Modifying headers in `TIdHTTPProxyServer` is fairly easy (see my answer). But, you do realize that, in order for this to work at all, users will have to reconfigure their browsers to connect through your proxy, don't you? Are you sure this is the option you want to pursue? Or, are you looking for a more transparent solution? – Remy Lebeau Jun 02 '21 at 18:08
  • @RemyLebeau sorry I should have been more specific. Yes the intention as indicated by Olivier is to remove the X-Frame-Options in the header so I can embed a website into an Iframe. Yes I am also aware it would need the users to configure their proxy settings. Can you elaborate more on what you mean by a transparent solution? – user2365039 Jun 02 '21 at 22:52
  • @user2365039 "*Can you elaborate more on what you mean by a transparent solution?*" - meaning one that doesn't require browser reconfiguration, it "just works" behind the scenes for you. – Remy Lebeau Jun 02 '21 at 23:26
  • @RemyLebeau yes that would be the ideal scenario. Do you have any suggestions? – user2365039 Jun 04 '21 at 01:22

2 Answers2

1

When using TIdHTTPProxyServer, you can modify HTTP headers for GET/POST/HEAD requests only, in the following events:

  • OnHTTPBeforeCommand event (client headers)
  • OnHTTPResponse event (server headers)
  • OnHTTPDocument event (client or server headers, depending on the TIdHTTPProxyServerContext.TransferSource property) when the proxy's DefaultTransferMode property is set to tmFullDocument.

The headers are stored in the Headers property of the TIdHTTPProxyServerContext object provided to each event.

For example, using the OnHTTPResponse event, you can easily remove an X-Frame-Options header, eg:

procedure TMyForm.IdHTTPProxyServer1HTTPResponse(AContext: TIdHTTPProxyServerContext);
var
  I: Integer;
begin
  I := AContext.Headers.IndexOfName('X-Frame-Options');
  if I <> -1 then
    AContext.Headers.Delete(I);
end;

Or:

procedure TMyForm.IdHTTPProxyServer1HTTPResponse(AContext: TIdHTTPProxyServerContext);
begin
  AContext.Headers.Values['X-Frame-Options'] := '';
end;
Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
1

For the ProcessHTTPRequest - Resp: TIdHTTPResponseInfo - you can add this line to set the http header response:

Resp.CustomHeaders.Values['X-Frame-Options'] := 'Deny';

Works with the normal indy http server, should work with the proxy as well. In the same way you can set it to empty, or other values.

I came upon your post looking for a way to "add" it - i'm hoping this answer helps others who are looking for similar information, even if the actual answer isn't exactly what you're looking for in the OP.

T.S
  • 355
  • 4
  • 18