JavaScript HTTP Request Not in Incognito Mode

Question

I'm new to web development and am trying to build a small webpage that'll attempt to detect if anyone's currently logged into Instagram on that browser. If I run my code command-by-command in Chrome's console and manually copy-paste the HTML, it works perfectly. But when I try to run my code separately, it seems to run as if it was in Incognito mode.

How would one get around this? If the user needs to grant my page permission to access Instagram, how would I do that?

Here's the JS part of my code:

const USERNAME_REGEX = /"viewer"\:{.*"full_name"\:"([^"]+)"/gm;
  const FULLNAME = 'full_name\":\"';

  document.addEventListener('DOMContentLoaded', () => {
    const request = new XMLHttpRequest();
    request.open('GET', 'https://instagram.com');
    request.send();
    request.onload = () => {
      const data = request.responseText;
      var u = data.match(USERNAME_REGEX);
      if (u != null) {
        u = u[0];
        u = u.substring(u.indexOf(FULLNAME) + FULLNAME.length).slice(0, -1);
        document.querySelector('#info').innerHTML = u;
      }
      else {
        document.querySelector('#info').innerHTML = 'no one is logged in!';
      }
    }
  });

Thank you:) have a wonderful day!

Answer 1

I'm new to web development and am trying to build a small webpage that'll attempt to detect if anyone's currently logged into Instagram on that browser.

That sounds like a security and privacy nightmare, which fortunately for everyone (you included) isn't possible. (Or at least, it shouldn't be...)

If I run my code command-by-command in Chrome's console and manually copy-paste the HTML, it works perfectly.

Totally different context. You'll find, in fact, that if you run this code in a console that isn't on Instagram.com, it won't work.

Same-origin policy will prevent you from accessing another domain. What you're attempting is a classic cross-origin attack that isn't going to work. CORS would get around this, but Instagram surely isn't going to enable you access.

How would one get around this?

You don't.