New issue
Advanced search Search tips

Issue 854315 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Extensions: activeTab should allow interception of requests from a tab to cross-origin resources

Project Member Reported by rdevlin....@chromium.org, Jun 19 2018

Issue description

What steps will reproduce the problem?
1. Install an extension with activeTab that listens for all requests with the webRequest API.
2. Invoke the extension on a page to grant activeTab
3. Make a cross-origin request

What is the expected result?
The result should be seen by the extension's webRequest listener

What happens instead of that?
The request is blocked because the extension doesn't have access to the host.


We should change this so that extensions with activeTab can see requests from the tab they are granted permission to, even if they are cross origin.  However, there are some caveats:
- We shouldn't allow requests from cross-origin child frames.  That is, we will need to check the request's initiator against the extension's granted origin in order to determine if the request should be visible.
- Cross-origin requests should be stripped of request and response headers, which may contain cookies (and thus shouldn't be visible).
 
Cc: -karandeepb@chromium.org rdevlin....@chromium.org
Owner: karandeepb@chromium.org
I haven't had a chance to jump into this one yet, and karandeepb@'s probably more familiar with this area than I am now.  karandeepb@, do you think you'll be able to take this one on?  (If you're strapped for bandwidth, feel free to assign back to me.)
Just noting that as far as runtime-host-permissions is concerned, we already do give an extension access to a request if it has access to the request initiator and its access to the request itself is withheld.

Sign in to add a comment