是否可以通过代理嵌入安全的 https 页面或以某种方式抓取内容......？

Question

I am trying to embed or get the content of a https website and tried already some ways:

1. Iframe - is forbidden: [Error] Refused to display 'https:// any url ?width=100?data=data' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

2. Get the content with tunnel - CONNECT request. Is not allowed.

Is there any way, how i can achieve this? I have read many old posts, that this is possible, but i think all of them are deprecated. Can i proxy the website somehow?

Thanks for your help!

Answer 1

The browser adheres to the directives stated in headers found on web resources response, for various security reasons (eg, X-Frame-Options header that prevents loading in an iframe).

Old bypass methods that you might've found for these restrictions, are bound to be prevented eventually as they are considered security holes.

Notice that these are client-side restrictions. I believe that methods that involve a special client or a service that ignores these restricting headers, might be the right path to your problem. It all depends on what you're trying to achieve (Just showing the secured page content? Allowing the user to interact with the page? User can log-in to the secured website? etc.)

For example, a web service that fetches a page and serve it to the requesting client without the restricting headers.

This method isn't bulletproof - You might need to rewrite the resource's URLs in the HTML, deal with cookies, prevent javascript code from detecting if the page is in an iframe, etc.