How Can I Override Javascript Files Referenced With The Crossorigin="anonymous" Using A Google Chrome Extension?

In the response HTML of a website, with a domain like http://www.example.com, there are many javascript files referenced. One of them references a javascript file on a different do

Solution 1:

Your attempted solutions don't work, because the only relevant headers for CORS are those that are served by the original resource. If this CORS check succeeds, then the redirects are checked and so on.

However, it appears that the initial CORS check failed already..I've reported this bug at https://code.google.com/p/chromium/issues/detail?id=387198.

There is a work-around. Since Chromium 35.0.1911.0, you can redirect requests at the chrome.webRequest.onHeadersReceived event. Redirecting a cross-origin request at this stage seems to work if you set the access-control-allow-origin: * together with redirectUrl. A small disadvantage of this approach is that the request is not immediately redirected, but only after receiving a response from the origin request. If the original request results in an error, e.g. a 404, then your redirect won't happen at all. Nevertheless, it is the only way to get the desired effect until the bug is fixed.

chrome.webRequest.onHeadersReceived.addListener(function(info) {
    return {
        responseHeaders: info.responseHeaders.concat([{
            name: 'access-control-allow-origin',
            value: '*' 
        }]),
        redirectUrl: "http://localhost:2222/custom.js"
    };  
}, {
    urls: [
        "*://example.net/script.js"
    ],  
    types: ["script"]
}, ["blocking", "responseHeaders"]);

Note: Regardless of the method, the target of the redirect must also include an appropriate access-control-allow-origin header, or the request will still be aborted with the following error:

Redirect at origin 'http://example.net' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:4444' is therefore not allowed access.