Browse the web through a Domain B backend

This single file can live on any static host (Domain A). It fetches backend-rewritten HTML from Domain B, turns it into a blob: URL, and renders that in the sandboxed frame below.

Idle.

blob URL: —

Embed snippet

Deep-link with a hash — the page auto-loads #<target-url> on start. Embed this file anywhere:

<iframe src="https://domainA/index.html#https://example.com"
  sandbox="allow-scripts allow-forms allow-same-origin allow-popups"
  style="width:100%;height:80vh;border:0"></iframe>

CORS note

Domain B sends Access-Control-Allow-Origin: * on /api/fetch, so this Domain A page can fetch() it cross-origin with no proxy of its own and no Service Worker. If you point “backend” at a host without that header, the browser blocks the fetch and the status line shows the error.

Why no Service Worker?

NO-SW RIFT rewrites HTML/CSS/JS on the server (single /api/fetch path, XOR-0x01 + base64url codec). The client is just this file plus the injected runtime — nothing to install, no SW scope to break, works from any static host.