如何破解X-Frame-Options deny？

作者：Ran

2020-10-12 Ran

以WhatsApp网页版为例。

代码：

<iframe src=”https://web.whatsapp.com/”></iframe>

报错：

Refused to display ‘https://web.whatsapp.com/’ in a frame because it set ‘X-Frame-Options’ to ‘deny’.

破解：

chrome.webRequest.onHeadersReceived.addListener(

function (info) {

var headers = info.responseHeaders

for (var i = headers.length – 1; i >= 0; i–) {

var header = headers[i].name.toLowerCase()

if (header == ‘x-frame-options’ || header == ‘frame-options’) {

headers.splice(i, 1)

}

}

return { responseHeaders: headers }

},

{

urls: [‘*://*.whatsapp.com/*’],

types: [‘main_frame’, ‘sub_frame’]

},

[‘blocking’, ‘responseHeaders’]

)