0

I am working on a Chrome Extension which is structured like this :

  • the service_worker : fetches a list of compatible websites every day and if it is compatible, I will inject a 'widget' in the website
  • the widget : is a React App injected inside the page (a 300x300px position:absolute div) that can help the user and that is linked to the user account from my website, for example he can save a product from Amazon and see it later in his account in my website.

My problem is the communication between these two parts. An example : I want to check if the user has currently a session opened in my website, if yes, in the React App (the widget) I will render him some tools and his items, and if not I will render him a link to login in my website.

Tried solutions:

  • Call my website API directly from the widget : but I dont want to make the verification from the widget because it is a part of the webpage and I am afraid of a cookie/token hijacking (tell me if i'm wrong).

  • Using CustomEvents to get a response : I found this useful post, the problem is that as said in the 5th point I cant really wait for a response from the service_worker and store it.

  • Using CustomEvents with callbacks : I also can't send a callback function as said here.

  • Using sendMessage from Chrome API : To use this between webpage and the service_worker you need to specify in the manifest.json the pattern of every website that needs to use it, but the list can change every day. Also the domain cannot be *, and we cannot use <all_urls>

So, my communication is only working from the web page to the extension but not in the opposite way.

Can you advise me a way of making this work ? Thanks !

cbdev
  • 243
  • 3
  • 12
  • 1
    Point #5 actually shows how to wait for a response, so just use it. OTOH I would recommend an entirely different approach: embed a web_accessible_resources iframe with your react app inside (a generic example is [shown here](/a/25100953), but you can also find a react component for web_accessible_resources iframes). This iframe can make the network requests directly without the page knowing. – wOxxOm Apr 11 '22 at 12:06
  • Thanks for (all) your answer @wOxxOm So you say that any ajax call made inside the iframe is not catchable by the page ? And that it is safe from XSS/hijacking in my case ? – cbdev Apr 11 '22 at 12:56
  • 1
    Yes, it runs in a different OS process. – wOxxOm Apr 11 '22 at 12:56

0 Answers0