Node.JS Checking for iframes

[malc_b]

I have some stuff I'm working on using node, express and ejs. It's ticking along alright. The basic premise is that the routes for pages all include certain navigation elements with the story element in the middle section. What I'm trying to do now is to let that middle section be loaded into an iframe on someone else's site without any of the nav stuff. My idea was to have the express code check if the request for the route is from a user (either by directly accessing the page or via a link from the navigation section) or from any other site by way of iframe. Is there a way to do this without adding extra to the link from the external iframe? TIA

 

[Antero360]

I have some stuff I'm working on using node, express and ejs. It's ticking along alright. The basic premise is that the routes for pages all include certain navigation elements with the story element in the middle section. What I'm trying to do now is to let that middle section be loaded into an iframe on someone else's site without any of the nav stuff. My idea was to have the express code check if the request for the route is from a user (either by directly accessing the page or via a link from the navigation section) or from any other site by way of iframe. Is there a way to do this without adding extra to the link from the external iframe? TIA

Hi there @malc_b

If I may ask, what is the purpose for this? Is there a particular reason why you would need to load said pages onto someone else's site? Asking because this opens up the external site for potential security vulnerabilities.

 

[malc_b]

Tbh it was just an idea that came to me in terms of being able to load the content to another site (perhaps to another version of my own or perhaps another). The content window on the remote site would just be a frame with the source page displayed. The source page itself is partly ejs template and some js to perform a calculation, with out any saving or similar. If you think there are security issues could you perhaps identify some examples for me as I'm a little naive on that front.

 

[Antero360]

Tbh it was just an idea that came to me in terms of being able to load the content to another site (perhaps to another version of my own or perhaps another). The content window on the remote site would just be a frame with the source page displayed. The source page itself is partly ejs template and some js to perform a calculation, with out any saving or similar. If you think there are security issues could you perhaps identify some examples for me as I'm a little naive on that front.

Right off the bat, I can tell you if you would like to add your content on someone else's site, you would definitely need to reach out to the site owner(s) and/or developers in order to get their permission to do so. As far as security vulnerabilities are concerned, that would technically be an HTML injection attack. You would be injecting your own html onto the iframe of someone else's site. If you are adding any scripts onto that html, then that would be a Cross Site Scripting (XSS) attack. Again, these are just two vulnerabilities that I can see right off the bat without seeing any code. As I mentioned before, your best bet is to reach out to the site owner/devs and get permission to either have you provide the content you would like to see on there, and they add it in, or provide them with an api endpoint that will provide the content.

 

[malc_b]

I see where you are coming from with that but I may have been a little less than clear. It wasn't to try and add my own stuff to someone's site without permission but to allow them to use the content from mine on their own via the frame.
As for ths XSS i came up against that nightmare while trying to split the template layouts for the content from the calculations that were initially held on another domain. MOst of the stuff I've seen on APIs are mainly geared at returning or adding records to a database or similar. The APi I designed was to return an object of a big stack of variables. Is there a way to return the html and js of a webpage via an API (I couldn't even visualize the idea tbh!)

 

[Antero360]

I see where you are coming from with that but I may have been a little less than clear. It wasn't to try and add my own stuff to someone's site without permission but to allow them to use the content from mine on their own via the frame.
As for ths XSS i came up against that nightmare while trying to split the template layouts for the content from the calculations that were initially held on another domain. MOst of the stuff I've seen on APIs are mainly geared at returning or adding records to a database or similar. The APi I designed was to return an object of a big stack of variables. Is there a way to return the html and js of a webpage via an API (I couldn't even visualize the idea tbh!)

Here's something to get you started on that

Rendering HTML Pages as an HTTP Server Response Using Node.js

In this article, we will consider the various approaches to rendering an HTML page. We will create a Node.js server using Express.js and render the HTML page an HTTP server response.

www.section.io

 

[malc_b]

Seeing as I'm using express right now that may well help. Thanks.