rune/feltetproxy
1
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
No description
3 commits 1 branch 2 tags 39 KiB
  • Go 100%
Find a file
Exact
Rune Jensen 29332cb91a
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details
ci/woodpecker/tag/woodpecker Pipeline was successful
Details
Bypass the pay-or-consent CMP by stubbing it instead of stripping it 
Stripping the cmp.iife script tag left window.payOrConsentCMP undefined;
the app calls .init()/.doWeHaveConsent() unconditionally during hydration,
so it threw and Svelte blanked the page (and the components re-inject the
tag anyway). Instead inject a no-op payOrConsentCMP stub in <head> that
never grants consent (keeps ads/tracking/paywall dormant), and serve the
cmp.iife/intowow assets empty so the real CMP can't overwrite it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-06 17:38:14 +00:00
.gitignore Add Woodpecker CI pipeline releasing to code.jaduer.dk 2026-07-06 17:25:09 +00:00
.woodpecker.yaml Add Woodpecker CI pipeline releasing to code.jaduer.dk 2026-07-06 17:25:09 +00:00
go.mod Feltetproxy 2026-07-06 17:22:54 +00:00
go.sum Feltetproxy 2026-07-06 17:22:54 +00:00
main.go Feltetproxy 2026-07-06 17:22:54 +00:00
proxy.go Bypass the pay-or-consent CMP by stubbing it instead of stripping it 2026-07-06 17:38:14 +00:00
README.md Feltetproxy 2026-07-06 17:22:54 +00:00
rewrite.go Bypass the pay-or-consent CMP by stubbing it instead of stripping it 2026-07-06 17:38:14 +00:00
rewrite_test.go Bypass the pay-or-consent CMP by stubbing it instead of stripping it 2026-07-06 17:38:14 +00:00

README.md

feltetproxy

A small reverse proxy for feltet.dk that keeps your browser completely cookie-free:

  • All upstream cookies live in a proxy-side jar (net/http/cookiejar). Every Set-Cookie header is stripped before responses reach the browser, and browser Cookie headers are never forwarded upstream.
  • The Cookiebot consent banner never renders — the first-party CMP bundle (cmp.iife.<hash>.js) and the intowow ad-injection script are stripped from HTML. feltet.dk serves full content without consent, so nothing is lost.
  • Ad/tracker URLs are neutered: references to doubleclick.net, googletagmanager.com, google-analytics.com, googlesyndication.com, cookiebot.com, admanager/tag-matcher (ekstrabladet.services) and lwgadm.com are rewritten to the proxy's /blocked sink, which answers 204 No Content.
  • Navigation stays on the proxy: https://(www.)feltet.dk URLs in HTML, JS, JSON and CSS (including \/-escaped JSON forms) are rewritten to the proxy origin.
  • Allow-listed third parties (JW Player video, feltet's own asset/API hosts) are fetched through /ext/<host>/..., cookie-stripped like everything else. Any other host gets 403.

Run

go build -o feltetproxy .
./feltetproxy              # listens on 127.0.0.1:8080
./feltetproxy -listen 127.0.0.1:8888

Then browse http://localhost:8080.

Adding allow-listed hosts

Exact hosts go in extAllowed, whole CDN domains with variable subdomains in extAllowedSuffixes (both in proxy.go). Suffix-allowed domains also need a matching entry in extSuffixRe (rewrite.go) so URLs in response bodies and Location headers get rewritten to /ext/<host>/.

Notes

  • The jar is in-memory: cookies vanish on restart. That includes any login session — log in again after restarting the proxy.
  • CSP/HSTS headers are stripped so rewritten pages work over plain http from localhost. Don't expose the listener beyond localhost.
  • If your local DNS blocklists a media CDN (e.g. *.jwpsrv.com → ::), those assets 502 through the proxy too — that's the blocklist, not the proxy.

Tests

go test ./...