1

We have set up a reverse proxy to Facebook. We wound up another subdomain on our server and pointed it at https://www.facebook.com using the following web.config. (Redacted slightly for security's sake.)

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
      <rules>
        <rule name="ReverseProxyInboundRule1" stopProcessing="true">
          <match url="(.*)" />
          <action type="Rewrite" url="https://www.facebook.com/{R:1}" />
          <serverVariables>
            <set name="HTTP_X_ORIGINAL_ACCEPT_ENCODING" value="{HTTP_ACCEPT_ENCODING}" />
            <set name="HTTP_ACCEPT_ENCODING" value="" />
          </serverVariables>
        </rule>
        <rule name="Capture Http Origin Header">
          <match url=".*" />
          <conditions>
            <add input="{HTTP_ORIGIN}" pattern=".+" />
          </conditions>
          <serverVariables>
            <set name="HTTP_X_HTTP_ORIGIN" value="{C:0}" />
          </serverVariables>
          <action type="None" />
        </rule>
      </rules>
      <outboundRules>
        <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
          <match filterByTags="A, Form, Img" pattern="^http(s)?://facebook.com/(.*)" />
          <action type="Rewrite" value="http{R:1}://sub.domain.com.au/{R:2}" />
        </rule>
        <rule name="Rewrite X-Frame-Options" enabled="true" patternSyntax="Wildcard">
          <match serverVariable="RESPONSE_X-Frame-Options" pattern="*" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" />
        </rule>
        <rule name="Set-Access-Control-Allow-Origin for known origins" enabled="true">
          <match serverVariable="RESPONSE_Access-Control-Allow-Origin" pattern=".+" negate="true" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" value="{HTTP_X_HTTP_ORIGIN}" />
        </rule>
        <rule name="Restore Accept Encoding" preCondition="Needs to Restore Original Accept Encoding" enabled="true">
          <match serverVariable="HTTP_ACCEPT_ENCODING" pattern="^(.*)$" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" value="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" />
        </rule>
        <preConditions>
          <preCondition name="ResponseIsHtml1">
            <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
          </preCondition>
          <preCondition name="Needs to Restore Original Accept Encoding">
            <add input="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" pattern=".*" />
          </preCondition>
        </preConditions>
      </outboundRules>
    </rewrite>
  </system.webServer>
</configuration>

Now I can have an html file with an iframe in it with an src of "https://sub.domain.com.au/someFacebookSite" and have Facebook at that site appear in the iframe without the usual CORS-related notifications.

The site in the iframe doesn't pick up the Facebook login details from any of the other browser windows. I expect that that is by design. Nevertheless, is it possible to inform the page in the iframe about other windows/iframes where Facebook is currently loaded so that the iframe-d page may load account authorisation data?

3
  • 1
    "The site in the iframe doesn't pick up the Facebook login details from any of the other browser windows." - As far as the browser is concerned, you are connecting to https://sub.domain.com.au/, not facebook.com so I would think browser security is going to prevent any cross-talk.
    – MrWhite
    Aug 21, 2020 at 12:17
  • Okay, I'll run with that. Reverse proxying FB was a " can we do this" project so now we know we can't. Chapter closed.
    – bugmagnet
    Aug 24, 2020 at 2:35
  • 1
    I would also think that FB would "try their best" to prevent anyone from creating a reverse proxy to FB. (?)
    – MrWhite
    Aug 24, 2020 at 11:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.