Search code examples
xsscross-site

How did Google Translate Website can modify webpage without subject to cross-site scripting?


I thought if I get a content from other site (like in iframe) then I could not do anything with it when it is not from the same domain. But Google seemed to be able to modify the text of webpage?

How can I write a JavaScript so that I can select an object in a fetched iframe then modify it client side too?


Solution

  • As Frédéric Hamidi said in the comment, that is an answer. For the sake of completing this question I will self-answer with that.

    Translate is not modifying the page, it is rewriting it. In other words, it loads the page server-side and generates a new page that it serves you. If you examine the URL of the inner frame, you will see it is https://translate.googleusercontent.com/translate_c?... not the original one.