We have set up a reverse proxy to Facebook. We wound up another subdomain on our server and pointed it at https://www.facebook.com using the following web.config. (Redacted slightly for security's sake.)

<?xml version="1.0" encoding="UTF-8"?>
        <rule name="ReverseProxyInboundRule1" stopProcessing="true">
          <match url="(.*)" />
          <action type="Rewrite" url="https://www.facebook.com/{R:1}" />
            <set name="HTTP_ACCEPT_ENCODING" value="" />
        <rule name="Capture Http Origin Header">
          <match url=".*" />
            <add input="{HTTP_ORIGIN}" pattern=".+" />
            <set name="HTTP_X_HTTP_ORIGIN" value="{C:0}" />
          <action type="None" />
        <rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1">
          <match filterByTags="A, Form, Img" pattern="^http(s)?://facebook.com/(.*)" />
          <action type="Rewrite" value="http{R:1}://sub.domain.com.au/{R:2}" />
        <rule name="Rewrite X-Frame-Options" enabled="true" patternSyntax="Wildcard">
          <match serverVariable="RESPONSE_X-Frame-Options" pattern="*" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" />
        <rule name="Set-Access-Control-Allow-Origin for known origins" enabled="true">
          <match serverVariable="RESPONSE_Access-Control-Allow-Origin" pattern=".+" negate="true" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" value="{HTTP_X_HTTP_ORIGIN}" />
        <rule name="Restore Accept Encoding" preCondition="Needs to Restore Original Accept Encoding" enabled="true">
          <match serverVariable="HTTP_ACCEPT_ENCODING" pattern="^(.*)$" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true" />
          <action type="Rewrite" value="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" />
          <preCondition name="ResponseIsHtml1">
            <add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />
          <preCondition name="Needs to Restore Original Accept Encoding">
            <add input="{HTTP_X_ORIGINAL_ACCEPT_ENCODING}" pattern=".*" />

Now I can have an html file with an iframe in it with an src of "https://sub.domain.com.au/someFacebookSite" and have Facebook at that site appear in the iframe without the usual CORS-related notifications.

The site in the iframe doesn't pick up the Facebook login details from any of the other browser windows. I expect that that is by design. Nevertheless, is it possible to inform the page in the iframe about other windows/iframes where Facebook is currently loaded so that the iframe-d page may load account authorisation data?

  • 1
    "The site in the iframe doesn't pick up the Facebook login details from any of the other browser windows." - As far as the browser is concerned, you are connecting to https://sub.domain.com.au/, not facebook.com so I would think browser security is going to prevent any cross-talk.
    – MrWhite
    Commented Aug 21, 2020 at 12:17
  • Okay, I'll run with that. Reverse proxying FB was a " can we do this" project so now we know we can't. Chapter closed.
    – bugmagnet
    Commented Aug 24, 2020 at 2:35
  • 1
    I would also think that FB would "try their best" to prevent anyone from creating a reverse proxy to FB. (?)
    – MrWhite
    Commented Aug 24, 2020 at 11:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.