dvorakmortonxd/dvorakmortonxd.dev
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

load skopec.dev live in its window via an allowlisted header-stripping proxy (/api/frame)

Browse source
This commit is contained in:
Martin Dvořák 2026-09-30 06:42:36 +00:00
commit a4a12bfe2a
5 changed files with 147 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -42,9 +42,10 @@ heatmap**, a gym SBD panel and links to friends' sites.
A spinner covers the frame while the site boots. Discord sends `DENY` and keeps a link card
instead.
- **Friend sites in windows** — clicking a friend's desktop icon opens their site in a
window. `bukovinafilip.com` and `vlcak.me` send no framing headers, so they load live;
`skopec.dev` sends `X-Frame-Options: SAMEORIGIN`, so the window frames the bundled mirror
at `/skopec.html` and the `www` button opens the real site.
window. `bukovinafilip.com` and `vlcak.me` send no framing headers, so they load directly;
`skopec.dev` sends `X-Frame-Options: SAMEORIGIN`, so it loads through `/api/frame`, a
header-stripping proxy that serves the live page from our origin. The `www` button always
opens the real site.
- **Minecraft-style SMP window** — the SMP shortcut opens a join menu modelled on
Minecraft's multiplayer screen, with live status, player count, MOTD and version pulled
from mcstatus.io through the site's own ping API.
@ -156,6 +157,7 @@ they contend for `:3000` and `.next/dev/lock`.
| --- | --- | --- |
| `/api/heatmap` | `GET` | Proxies the user's contribution heatmap from `git.dvorakmortonxd.dev`. |
| `/api/activities` | `GET` | Fetches the GitDXD activity feed and keeps only the user's own events. |
| `/api/frame?url=…` | `GET` | Header-stripping proxy for a friend's site that refuses framing (`skopec.dev`). **Allow-listed hosts only**; fetches the HTML server-side (so the site's `X-Frame-Options` never reaches the browser), injects a `<base>` for relative assets and a click shim for in-site links. Rejects other hosts, non-http(s) schemes and credentials, and never follows redirects. |
| `/api/ping?url=…` | `GET` | Health-checks an **allow-listed** service (the site's own `*.dvorakmortonxd.dev` hosts and the friends' sites). Handles `minecraft://host:port` via mcstatus.io; treats any non-5xx response as "up". Other hosts and schemes are rejected and redirects are never followed, so it can't be used to probe the LAN (SSRF guard). |
## 📁 Project Structure