Skip to content

Instantly share code, notes, and snippets.

@jhass jhass/ forked from chitsaou/
Last active Aug 21, 2019

What would you like to do?
Proxy to remote server with CORS support for mitmproxy

Hacking CORS restriction to enable in-browser XHR to any server.


Say you are running an web app at localhost, and you want to send XHR to http://remote-server:80, but the CORS restriction forbids access because you are sending requests from an origin that remote-server:80 does not allow.


mitmproxy -s -R http://remote-server:80 -b localhost -p 8080

Now localhost:8080 is tunnelled to remote-server:80.

And you can XHR to proxied server from localhost:

  .then(function(response) {
    // enjoy the response

Bonus: You can inspect HTTP requests in mitmproxy.

from mitmproxy import http
def response(flow):
flow.response.headers["Access-Control-Allow-Origin"] = "*"
# Use this if the application sends auth info via header
flow.response.headers["Access-Control-Expose-Headers"] = "Authorization"
def request(flow):
# Hijack CORS OPTIONS request
if flow.request.method == "OPTIONS":
flow.response = http.HTTPResponse.make(200, b"",
{"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "GET,POST",
"Access-Control-Allow-Headers": "Authorization",
"Access-Control-Max-Age": "1728000"})
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.