Web-Widget erstellen, das auf "Third-Party-Websites" eingebunden werden kann (CORS)

Code:

cors.config:

    enabled: true

    # Specify allowed headers, like 'x-allowed-header'.

    allowedHeaders: ['x-csrf-token','authorization','content-type','accept','origin','x-requested-with', 'access-control-allow-origin','x-allowed-header']

    # Specify allowed request methods, specify ['*'] to allow all possible ones.

    allowedMethods: ['POST', 'GET', 'OPTIONS', 'PATCH', 'DELETE']    

    # Configure requests allowed from specific origins.

    allowedOrigins: ['https://www.third-party-website.de']

    # Sets the Access-Control-Expose-Headers header.

    exposedHeaders: []

    # Sets the Access-Control-Max-Age header.

    maxAge: false

    # Sets the Access-Control-Allow-Credentials header.

    supportsCredentials: true

Code:

function injectSameOriginIframeFromRemote(remoteSrcUrl, target, append, OPT_cb, OPT_useProxy) {

    var PROXY_BASE = 'https://cors-anywhere.herokuapp.com';

    useProxy = typeof(OPT_useProxy)==='boolean' ? OPT_useProxy : true;

    cb = typeof (OPT_cb) === 'function' ? OPT_cb : function () { };

    var iframe = document.createElement('iframe');

    if (append) {

        target.appendChild(iframe);

        iframe.style.width = '100%';

        iframe.style.height = '100%';

    }

    else {

        target.replaceWith(iframe);

    }

    var xhr = new XMLHttpRequest();

    xhr.onreadystatechange = function() {

        if (xhr.readyState === 4){

            if (xhr.status === 200){

                var rawHtml = xhr.responseText;

                var baseString = '';

                rawHtml = rawHtml.replace(/]+>/gim,'');

                rawHtml = rawHtml.replace(/<\/head>/gim,baseString + '\n' + '');

                iframe.contentWindow.document.open();

                iframe.contentWindow.document.write(rawHtml);

                iframe.contentWindow.document.close();

            }

            else {

                cb(false);

            }

        }

    }

    xhr.open('GET',PROXY_BASE + '/' + remoteSrcUrl);

    xhr.send();

    iframe.addEventListener('load', cb);

}

Code:

let response = await fetch('https://site.com/service.json', {

  method: 'PATCH',

  headers: {

    'Content-Type': 'application/json',

    'API-Key': 'secret'

  }

});