[WordPress] 外掛分享： Juliet Just Masks

內容簡介

Juliet Just Masks 是一款高效能的 URL 掩碼與反向代理管理工具，能讓 WordPress 以隱形代理的方式運作，無縫處理動態內容，並保持訪客的地址欄不變，提供更流暢的使用體驗。

【主要功能】
• 原生 URL 掩碼：在自訂網域上提供遠端應用程式和登陸頁面
• 智能掩碼管理器：可視化儀表板即時管理 URL 掩碼
• 快速路徑反向代理：零延遲路由匹配以提高請求速度
• SPA & <base> 標籤注入：確保資源正確路由
• 資源與連結修補：自動重寫 URL 以符合本地命名空間
• SSRF 保護與安全性：企業級 IP 和協議驗證保護伺服器

外掛標籤

開發者團隊

原文外掛簡介

Juliet Just Masks is a high-performance URL masking and reverse proxy mask manager for WordPress. While Romeo Redirect Manager handles open redirects, Juliet provides seamless stealth routing and URL masking.
As a lightweight, native URL masker, Juliet lets WordPress act as a stealth reverse proxy. It intercepts specific incoming paths, keeps the visitor’s address bar unchanged, and fetches/renders dynamic HTML, React/Vue SPAs, or external landing pages behind the scenes.
Why use Juliet Mask Manager?

Native URL Masking — Serve remote applications, microservices, and landing pages on your own custom domain without iframes or server configuration.
Smart Mask Manager — Visual dashboard to create, manage, sort, search, and toggle active/inactive URL masks in real time.
Fast Path Reverse Proxy — Zero-latency early route matching hooks before WP Query to proxy requests at top speed.
SPA & Tag Injector — Keeps relative script chunks, assets, and API requests properly routed through the proxy.
Asset & Link Patcher — Rewrites root-relative URLs, internal CSS url() assets, and external navigation links into your local mask namespace.
SSRF Protection & Security — Enterprise-grade IP and protocol validation protects your server from unsafe outbound requests.
Companion to Romeo Redirect Manager — The complete routing suite: Romeo for redirection, Juliet for masking.

Features

Stealth Routing Engine — Bypasses WP_Query to serve remote HTML without triggering a 404, supporting unlimited sub-paths.
Mask Manager Dashboard — Intuitive card and list views with live search, custom dropdown filtering, and instant AJAX toggles.
URL Masker & Link Masking — Automatically rewrites remote URLs and same-origin links into your local slug namespace.
Asset Dependency Patcher — Rewrites root-relative asset paths (/css/style.css, srcset, inline url(), data-src) on the fly.
Proxy Header Passthrough — Forwards visitor IP (X-Forwarded-For), User-Agent, language, and protocol for accurate analytics.
SSRF Protection — Validates protocols, credentials, and DNS against private IP ranges.
DOM Injector — Smart injection tailored for complex JavaScript/AJAX-heavy SPAs.
Asset Caching & MIME Typing — Built-in static asset caching headers and strict MIME type detection for scripts and styles.
Graceful Failsafe — Theme-native 404 fallback if a remote server is unreachable.
Method Pass-Through — Supports GET, POST, PUT, PATCH, DELETE, and CORS OPTIONS preflight requests.

Example

Go to Juliet Just Masks in wp-admin.
Click Create New Mask.
Enter the Local Path: marketing-hub.
Enter the Remote Target URL: https://external-landing-page.com/promo-1.
Save.

Visiting yoursite.com/marketing-hub now renders the remote landing page while the address bar still shows yoursite.com/marketing-hub. Deeper paths work too: yoursite.com/marketing-hub/pricing proxies the remote app’s /pricing route.
Known limitations

CORS — if the remote server sends strict CORS headers for its assets, browsers may block cross-origin subresources. The remote must allow your domain (or serve assets with permissive CORS).
Remote sessions — Set-Cookie responses are not forwarded (cookies would be scoped incorrectly). Authenticated remote applications need additional cookie handling; forwarding the visitor’s cookies upstream is available via the juliet_forward_cookies filter but leaks this site’s auth cookies, so only enable it for trusted targets.
DNS rebinding — SSRF validation resolves DNS separately from the fetch. A hostile target could rotate DNS between check and fetch. Only mask targets you control or trust.
Lazy-loaded assets — attributes such as data-src set by JavaScript after load cannot be patched server-side; enable injection for those apps.

Filters (developer reference)

juliet_target_url — filter the final outbound URL (args: $url, $mask, $subpath).
juliet_timeout — remote fetch timeout in seconds (default 15).
juliet_cache_ttl — response cache TTL in seconds (default 300, 0 disables).
juliet_max_cache_bytes — max cacheable body size (default 2 MB).
juliet_proxy_headers — outbound proxy headers (args: $headers, $mask, $url).
juliet_forward_cookies — forward the visitor’s Cookie header upstream (default false).
juliet_allow_private_targets — allow private/internal network targets (default false).
juliet_apply_link_masking — rewrite same-origin remote links into the slug namespace (default true).
juliet_reserved_slugs — slugs that may never be registered as masks.
juliet_request_args — full wp_remote_request() argument override.
juliet_honor_loop_guard — block requests that already carry the proxy signature (default true).