You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

Chrome扩展declarativeNetRequest在Gmail中失效问题求助

问题:Chrome扩展iframe抓取Gmail失败,Drive正常的问题分析与解决

我开发的Chrome扩展通过受控iframe抓取指定页面,抓取Gmail收件箱时请求失败,报错:

Refused to display 'https://mail.google.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'

但抓取Google Drive时可正常运行。

Gmail和Drive均设置了X-Frame-Options: SAMEORIGIN,我通过declarativeNetRequest移除该响应头及其他相关头来规避此限制,代码如下:

chrome.declarativeNetRequest.updateSessionRules({
    removeRuleIds: [1001],
    addRules: this.createRulesFor(patterns, [1001], tabId),
})

...

private createRulesFor(patterns: string[], ids: number[], tabId: number): Rule[] {
    let rules: Rule[] = [];

    rules.push({
        id: ids[0],
        priority: 1,
        action: {
            type: RuleActionType.MODIFY_HEADERS,
            responseHeaders : [
                ...this.createHeaderToRemove("X-Frame-Options"),
                ...this.createHeaderToRemove("Content-Security-Policy"),
                ...this.createHeaderToRemove("Content-Security-Policy-Report-Only"),
                ...this.createHeaderToRemove("Cross-Origin-Embedder-Policy"),
                ...this.createHeaderToRemove("Cross-Origin-Owner-Policy"),
                ...this.createHeaderToRemove("X-Content-Type-Options"),
                ...this.createHeaderToRemove("X-Xss-Protection"),
            ]
        },
        // XXX doesn't handle HTTP2 / 999, whatever that is (e.g. linkedin)
        condition: {
            // urlFilter: patterns[i],
            tabIds: [ tabId ]
        }
    });
    return rules
}
...
private createHeaderToRemove(headerName: string) {
    const lowercaseHeader = headerName.toLowerCase();
    const capitalizedHeader = headerName.charAt(0).toUpperCase() + lowercaseHeader.slice(1);
    return [
        {
            header: headerName,
            operation: HeaderOperation.REMOVE
        },
        {
            header: lowercaseHeader,
            operation: HeaderOperation.REMOVE
        },
        {
            header: capitalizedHeader,
            operation: HeaderOperation.REMOVE
        }
    ];
}

注:最初我基于待抓取URL注入通配规则,后来改为使用tabId。

绑定chrome.declarativeNetRequest.onRuleMatchedDebug后发现,规则对Drive匹配,但对Gmail不匹配。

推测差异源于:将基础URL通过Chrome复制为curl命令执行时,Gmail会返回3-4次302重定向后才返回200,而Drive直接返回200。若此为问题根源,需解答:

  • a) 为何报错信息特指X-Frame-Options?
  • b) 如何在扩展控制的tab内的iframe中监听并跟随302重定向?

内容的提问来源于stack exchange,提问作者user717847

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级,最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分), 限时 9.9 元起

最近更新时间:2026.07.20 10:20:12