Browsers don't allow a JavaScript to spoof/modify 'Host' header. It's a part of a browser's security. For a regular user that is a feature, for me that is a limitation in a context of my tool which runs inside of a browser.

Host header spoofing was just an example, I would like the full control over issuing HTTP requests.

For purpose of greater control, I was thinking about creating an extension which would allow me to do this. (bypass browser's restrictions on my specific host) Or for an example, electron app would bring me that control, but it lacks mobile support. Apart from that, I would like to stay inside of a real of browsers.

Is there a way to provide an extra flexibility to JavaScript inside of a browser?

  • And dev tools are not enough? Or using a proxy like Burp to rewrite the traffic? – schroeder Sep 30 at 11:54
  • @schroeder Using a solution like Burp wouldn't be an option, since front-end would receive an instruction from the back-end on how to issue a request. Which makes it dynamic. And regarding to "And dev tools are not enough?", may you elaborate more, please? – Mobutu Sese Seko Kuku Ngbendu Sep 30 at 12:07
  • Firefox dev tools allow you to edit headers and resend. And it exposes a ton of other functions. – schroeder Sep 30 at 12:42
  • @schroeder Is it possible to do that programmatically? – Mobutu Sese Seko Kuku Ngbendu Sep 30 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.