FEATURE REQUEST: Drive modheader from markup

[ndtreviv]

I want to be able to click on a link on a page that opens in a new window, but have a specific header applied on the new window.

It would be cool if I could do this in the markup somehow:

<a href="link" modheader-data-HEADER_NAME="value" target="_blank">link text</a>

or similar.

Or even using javascript's window.open();

[hao1300]

Thanks for filing this feature request. We will look into this.

[hao1300]

Hi @ndtreviv, we thought a little more about this feature request, and decided to implement something slightly different: the ModHeader embedded button. You can learn more about it here: https://modheader.com/docs/embed. You can put the button on the page, and when you click on it, it will open a confirmation popup that will let you easily import your headers.

The reason why we didn't implement the feature as suggested is because:

1. Manipulating headers can be dangerous, and we want to make sure users are aware of the import instead of doing it silently.
2. Parsing HTML tags on a page may require ModHeader to request additional permissions to run content script on all pages, which we would prefer not to.
3. We need to handle the case where ModHeader is not installed on the user's browser yet (we wish it is installed on everyone's browser but it is obviously not the case)

We hope the embedded button is a good balance between usability and security. Please let us know when you have a chance to try it out, and if you need further customization on it.

Note: you may want to use ModHeader 4.3.4+ (which is still being rolled out). The embedded button works for older ModHeader versions as well, but the newer version will allow you to merge the headers into existing profile, and export your profile as an embedded button more easily.

[ndtreviv]

Hi @hao1300 - Thanks for this!
I understand the security risks behind invisibly setting request headers and I totally understand why you took this approach.

Some questions:

1. When I create a button like so:

<iframe src='https://modheader.com/embed/modheader?req-Referer=Blah' frameborder='0' width='180px' height='40px' title='Open with Referer' />

the text of the button still says: Import to Modheader rather than following the iFrame title. Is this intended? Can I change the button text and style?

2. Are there any event listeners I can hook in to? For example, I want to set the headers and then open a new window with a single action. Is that possible?

3. If there are headers already set in modheader, how does it handle duplicates or clearing? For example, say someone clicks a button like the example above:

<iframe src='https://modheader.com/embed/modheader?req-Referer=Foo' frameborder='0' width='180px' height='40px' title='Open with Referer' />

And then clicks another one:

<iframe src='https://modheader.com/embed/modheader?req-Referer=Bar' frameborder='0' width='180px' height='40px' title='Open with Referer' />

Will modheader then have two Referer headers configured?

Along the same lines if someone clicks a button with no value, eg:

<iframe src='https://modheader.com/embed/modheader?req-Referer=' frameborder='0' width='180px' height='40px' title='Open without Referer' />

will it clear the previous selection? or is there a way to programatically clear the previous selection?

Let me explain what I'm trying to do:
I want to open different sites with different request headers, but I only want to use the request headers for the request to each individual site.

Thanks for your help!

[hao1300]

@ndtreviv, Thanks for the feedbacks.

RE:
1, The iframe title tag is only for accessibility (for screen reader and for when the iframe failed to load, etc.). It is not intended to change the button text. If customizing the text is needed, we can make it as a URL parameter. We would prefer not to support customization for now though.

2, Not really. You can try to intercept the iframe click event or something, but probably not very robust. If this is only for yourself, you can try to do open up a popup window to this URL: https://modheader.com/popup/confirm?req-test=foo&product=ModHeader (Change the req-*=* to your desired header). Note that this is not supposed to be a public API, so we may change the URL spec in the future, but for now it should work for you (especially if you can assume that your browser already has ModHeader installed)

3, Currently the import button in the popup dialog has a dropdown that allows you to merge with existing profile or import as new profile. Based on your description it sounds like you want to always import as new profiles. What we can do is probably to save that preference and to immediately import when the popup is opened. Then you will only see a confirmation popup that the profile has been imported, rather than having to click through multiple buttons (note: this is not yet implemented, but we can probably support them next week or the week after). And if you follow the suggestion in (2) and open the popup window with window.open(), you can do a setTimeout() to close the popup window in a few seconds.