RequestManager & CORS Proxy

Relevant source files

• README.md
• api/proxy.ts
• docs/index.html
• scripts/test-proxy.js
• src/components/CORSBypassIndicator.tsx
• src/components/ErrorBoundary.tsx
• src/components/Footer.tsx
• src/components/ScanStatus.tsx
• src/components/WordPressInfo.tsx
• src/services/cloudflareBypass.ts
• src/services/corsProxy.ts
• src/services/requestManager.ts
• src/services/securityGradingService.ts
• vite.config.ts

This page documents the network orchestration layer of ABSpider Recon. Because the application is a zero-backend React SPA, it faces significant challenges regarding Cross-Origin Resource Sharing (CORS) and browser-level request limitations. The system solves this through a specialized RequestManager that handles rate limiting and retries, coupled with a multi-stage CORS bypass strategy involving a Vercel Edge Function proxy.

RequestManager

The RequestManager class is the central coordinator for all network activity during a scan. It wraps the fetchWithBypass utility to provide features necessary for stable security reconnaissance.

Key Responsibilities

• Rate Limiting: Ensures requests to the same domain do not exceed the minRequestInterval (default 200ms) src/services/requestManager.ts22-23
• Retry Logic: Automatically retries failed requests (up to 2 times by default) with exponential backoff, provided the failure wasn't an explicit abort src/services/requestManager.ts39-111
• Performance Tracking: Maintains a rolling buffer of RequestMetrics (metricsBufferSize: 50) to calculate average response times and error rates src/services/requestManager.ts24-186
• Lifecycle Management: Links individual requests to a global scanController signal, allowing for an immediate "Stop Scan" that kills all pending network I/O src/services/requestManager.ts27-60

Request Flow & Signal Combination

The manager uses a "combined signal" pattern. It merges the global scan-level AbortSignal with a request-specific timeout signal. If either triggers, the request is terminated src/services/requestManager.ts69-140

Request Lifecycle Diagram

This diagram shows how RequestManager processes a single fetch call through its internal state and rate limiter.

"RequestManager Lifecycle"

Sources: src/services/requestManager.ts33-126 src/services/requestManager.ts142-154

---

CORS Proxy & Bypass Strategy

Since browsers block direct requests to foreign domains (e.g., scanning a target's security.txt or headers), ABSpider Recon employs a two-tier bypass strategy implemented in corsProxy.ts.

1. Direct Fetch (Optimization)

The system first attempts a direct fetch from the browser with mode: 'cors' and specialized CLOUDFLARE_BYPASS_HEADERS src/services/corsProxy.ts4-166 This succeeds if the target has permissive CORS headers or is a known public API.

2. Vercel Edge Proxy (Fallback)

If the direct fetch fails or returns a 403/503 (indicating WAF/Cloudflare protection), the system routes the request through the api/proxy.ts Edge Function src/services/corsProxy.ts176-198

Data Flow: Browser to Target via Proxy

This diagram bridges the natural language concept of "CORS Bypass" to the specific code entities involved.

"CORS Bypass Data Flow"

Sources: src/services/corsProxy.ts134-222 api/proxy.ts6-92

---

Edge Function Implementation (api/proxy.ts)

The proxy is implemented as a Vercel Edge Function to minimize latency. It acts as a transparent relay that strips problematic browser headers and injects necessary CORS headers into the response.

Feature	Implementation Detail
Runtime	edge api/proxy.ts3
Header Filtering	Strictly allows accept, user-agent, authorization, content-type, etc. api/proxy.ts47-53
CORS Injection	Sets Access-Control-Allow-Origin: * on all proxied responses api/proxy.ts11-73
Method Support	Forwards GET, POST, and handles OPTIONS preflight api/proxy.ts13-61

Sources: api/proxy.ts1-92

---

Cloudflare Bypass Utility

The cloudflareBypass.ts service provides specialized detection and evasion techniques specifically for targets behind Cloudflare protection.

• Detection: Checks for cf-ray headers or specific HTML strings like "DDoS protection by Cloudflare" src/services/cloudflareBypass.ts9-78
• Techniques:
  1. Delay: Retrying with a 2-second pause src/services/cloudflareBypass.ts111
  2. User-Agent Rotation: Switching to common browser strings src/services/cloudflareBypass.ts121-127
  3. Proxy Escalation: Forcing the request through the corsProxy instance src/services/cloudflareBypass.ts116-118

Sources: src/services/cloudflareBypass.ts38-90 src/services/cloudflareBypass.ts92-145

---

Performance Metrics & UI Indicators

The RequestManager tracks the health of the network layer, which is utilized by the UI to inform the user of the connection status.

• Average Response Time: Calculated via a rolling average of the last 50 requests src/services/requestManager.ts178
• Error Rate: Percentage of requests in the buffer that resulted in !response.ok src/services/requestManager.ts91-183
• Adaptive Control: The adjustMinRequestInterval(newInterval) method allows the scan engine to slow down requests if the error rate climbs src/services/requestManager.ts189-192
• UI Indicators: The CORSBypassIndicator component displays a badge (Direct Fetch vs CORS Proxy Used) based on the CORSBypassMetadata returned by the proxy service src/components/CORSBypassIndicator.tsx11-41

Sources: src/services/requestManager.ts168-201 src/components/CORSBypassIndicator.tsx1-77