Extensions: activeTab should allow interception of requests from a tab to cross-origin resources |
|
Issue descriptionWhat steps will reproduce the problem? 1. Install an extension with activeTab that listens for all requests with the webRequest API. 2. Invoke the extension on a page to grant activeTab 3. Make a cross-origin request What is the expected result? The result should be seen by the extension's webRequest listener What happens instead of that? The request is blocked because the extension doesn't have access to the host. We should change this so that extensions with activeTab can see requests from the tab they are granted permission to, even if they are cross origin. However, there are some caveats: - We shouldn't allow requests from cross-origin child frames. That is, we will need to check the request's initiator against the extension's granted origin in order to determine if the request should be visible. - Cross-origin requests should be stripped of request and response headers, which may contain cookies (and thus shouldn't be visible).
,
Oct 3
Just noting that as far as runtime-host-permissions is concerned, we already do give an extension access to a request if it has access to the request initiator and its access to the request itself is withheld. |
|
►
Sign in to add a comment |
|
Comment 1 by rdevlin....@chromium.org
, Sep 6Owner: karandeepb@chromium.org