Question

Can you make someone to visit a HTTPS URL (for example https://graph.facebook.com/Enrique‘) via an iFrame/Script tag, and the visitor still don’t know what was the URL which got downloaded even if they check the ‘Network Console’ or something,

I’m free to use PHP ‘headers’ of something like that, but I would like to stay away from ‘cURL’ at server side, ’cause all I want is to make the visitor visit the URL with his own proxy to execute that url not my server(for preventing server load)

Answer 1

Nope. There are methods of obfuscating it to make it harder to understand, but nothing bulletproof. Perhaps you could try URL encoding the text parts. For example:

https://graph.facebook.com/%45%6e%72%69%71%75%65

(I think chrome automatically replaces unnecessarily url-encoded characters.)

Here’s some javascript that does this transform, I’m sure you could work up something similiar in PHP.

function percentEncodeAllChars(str) {

    var strEncoded = '';

    for(var i = 0, ilen = str.length; i < ilen; i++) {

        var strHex = parseInt(str.charCodeAt(i)).toString(16);
        strEncoded += '%' + strHex;
    }

    return strEncoded;
}

function doEncode() {

    var strInput = document.getElementById('encode').value;

    document.getElementById('result').innerHTML = percentEncodeAllChars(strInput);
}

Source