0

I'm writing a Chrome packaged app for diagnosing web services. I want to be able to send a GET request to a URL and look at the headers and data in the response.

My problem is if a users visits a site that has the HSTS header set before using my app, my app will then be unable send GET requests to the http:// URLs for that domain because Chrome will automatically convert the http:// URLs to https:// ones before the request is sent out.

Is there anything at all I can do to prevent this? I've looked into the webrequest API and webview tag but I'm finding nothing that lets me ignore HSTS.

Is it possible to use https://developer.chrome.com/apps/sockets_tcp for this (I would need to be able to support http, https and gzipped data)?

4

1 回答 1

0

我能做些什么来防止这种情况发生吗？

可能不是。如果您已经测试过<webview>并且它与浏览器共享 HSTS 列表，那么网络层将为您透明地重写它。

可以chrome.sockets.tcp用于这个吗？

从技术上讲，是的，HSTS 对此无关紧要。实际上，您需要从头开始实现 wget+SSL+gzip 之类的东西（在 JS、NaCl 或本机主机中 - 但在后一种情况下，您实际上并不需要内置套接字）。

于 2016-07-09T10:25:10.337 回答