9 ms·
Yeah, I keep having issues with CORS headers in Firefox and then it becomes really hard to pinpoint which extension caused what. I may be wrong but it didn't u
by rjzzleep 5y ago
Yeah, I keep having issues with CORS headers in Firefox and then it becomes really hard to pinpoint which extension caused what.
I may be wrong but it didn't used to be like that. It's a sideeffect of the whole webextension concept no?
- danShumway 5y agoMaybe? I vaguely remember webextensions not needing to do this. But I can't say that with certainty, because it might be that most websites didn't enable CORS so I never noticed, or I could just have the timeline mixed up in my head. I don't think anything about webextensions requires this problem to exist. So if it is a problem with webextensions, it's a problem we've "chosen" to have. And browsers could fix this without drastically overhauling anything with extensions. But I can not stress enough how much out of my depth I am commenting on this, my full knowledge is basically a couple days worth of research a year or two ago and some interaction on a bug report.
- kevingadd 5y agoAny proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have to run code outside of the page context, which automatically poses issues since the page is probably in another process.
- bfrit 5y agoThe problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.