any way to edit the response headers (or somehow disable X-Frame-Options)? about pywebview HOT 7 OPEN

Currently no, but I have been planning to add editing requests and responses. Help is welcomed.

from pywebview.

Hi, thanks for responding but would it be possible for you tell me where to start. I plan on reading the source code and make some quick tricks as a temp bandage solution but it would save me some time if you could point in the right direction...

from pywebview.

I envision API as follows. Both requests and responses could be accessed via window events, e.g. window.event.request_sent and window.event.response_received. Handlers would have headers: Dict parameter. If a dict is returned from a handler then it would become new headers. window.load_url could have an optional headers param as well. I have created a new headers branch.

As for actual platform specific implementation, googling for "renderername request/response headers" could be a good starting point. For example handling requests for Edge Chromium is described here https://learn.microsoft.com/en-us/microsoft-edge/webview2/how-to/webresourcerequested?tabs=dotnet. Basically you would attach to a correct handler on the actual webview and call something like

new_headers = window.event.response_received(headers)
if new_headers:
   #set headers here
else:
  #return original headers

ChatGPT has proved useful when it comes to writing platform specific code. It is especially good when it comes to getting platform specific syntax right.

I am not sure if it is possible to implement editing response headers on every platform. In particular I quickly glanced over macOS and could not find a way to do it.

from pywebview.

So after playing with edgechromium.py, editing the response headers is likely not possible with CoreWebView2.
I added

sender.CoreWebView2.AddWebResourceRequestedFilter('*', CoreWebView2WebResourceContext.All)
sender.CoreWebView2.WebResourceResponseReceived += self.on_web_resource_response

to on_webview_ready function and then tried editing the csp header with on_web_resource_response but it doesn't work:

def on_web_resource_response(self, sender, args):        
    if args.Response.Headers.Contains('content-security-policy'):
        args.Response.Headers.SetHeader('content-security-policy', '')

I also tried adding the --disable-web-security flag but to no avail...

Basically I am going to try one of the following approaches:

1. Use proxy server
2. Load extension
3. Use javascript

from pywebview.

The example on this page https://learn.microsoft.com/en-us/microsoft-edge/webview2/how-to/webresourcerequested?tabs=dotnet#overriding-a-response-to-proactively-replace-it creates a new response and assigns it to args.Response. Have you tried it?

// Add a filter to select all image resources
webView.CoreWebView2.AddWebResourceRequestedFilter(
      "*", CoreWebView2WebResourceContext.Image);
webView.CoreWebView2.WebResourceRequested += delegate (
   object sender, CoreWebView2WebResourceRequestedEventArgs args) {
    
   // Replace the remote image resource with a local one specified at the path customImagePath.
   // If response is not set, the request will continue as it is.
   FileStream fs = File.Open(customImagePath, FileMode.Open);
   CoreWebView2WebResourceResponse response = webView.CoreWebView2.Environment.CreateWebResourceResponse(fs, 200, "OK", "Content-Type: image/jpeg");
   args.Response = response;
};

from pywebview.

I don't follow as to why that would work. If an iframe tries loading another external website where its csp can't be controlled, then it shouldn't matter what the response was before retrieving that website. Changing the final response doesn't work it looks like.

from pywebview.

I have not tested it, but to me it looks like args.Response is a setter property, setting which sets header update. Editing headers in place would not achieve the same effect.

from pywebview.