4 ms·

> Yes, because Chrome's architecture forces extensions to do this, ironically in the name of security. To be fair, I think Firefox has this restriction too? I

> Yes, because Chrome's architecture forces extensions to do this, ironically in the name of security. To be fair, I think Firefox has this restriction too? I might be wrong, but I could have sworn I ran into some script-injection extensions that weren't working on some sites because of this problem. It's been a while since I checked, I eventually gave up on the extensions because I wanted to thin out my list and I wasn't comfortable with them overriding CORS headers -- so things may have changed, or maybe I misunderstood the situation even back then.

rjzzleep 5y ago
Yeah, I keep having issues with CORS headers in Firefox and then it becomes really hard to pinpoint which extension caused what. I may be wrong but it didn't used to be like that. It's a sideeffect of the whole webextension concept no?
- danShumway 5y ago
  Maybe? I vaguely remember webextensions not needing to do this. But I can't say that with certainty, because it might be that most websites didn't enable CORS so I never noticed, or I could just have the timeline mixed up in my head. I don't think anything about webextensions requires this problem to exist. So if it is a problem with webextensions, it's a problem we've "chosen" to have. And browsers could fix this without drastically overhauling anything with extensions. But I can not stress enough how much out of my depth I am commenting on this, my full knowledge is basically a couple days worth of research a year or two ago and some interaction on a bug report.
- kevingadd 5y ago
  Any proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have to run code outside of the page context, which automatically poses issues since the page is probably in another process.
  - bfrit 5y ago
    The problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.

rjzzleep 5y ago

Yeah, I keep having issues with CORS headers in Firefox and then it becomes really hard to pinpoint which extension caused what. I may be wrong but it didn't used to be like that. It's a sideeffect of the whole webextension concept no?

danShumway 5y ago
Maybe? I vaguely remember webextensions not needing to do this. But I can't say that with certainty, because it might be that most websites didn't enable CORS so I never noticed, or I could just have the timeline mixed up in my head. I don't think anything about webextensions requires this problem to exist. So if it is a problem with webextensions, it's a problem we've "chosen" to have. And browsers could fix this without drastically overhauling anything with extensions. But I can not stress enough how much out of my depth I am commenting on this, my full knowledge is basically a couple days worth of research a year or two ago and some interaction on a bug report.
kevingadd 5y ago
Any proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have to run code outside of the page context, which automatically poses issues since the page is probably in another process.
- bfrit 5y ago
  The problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.