Re:Chrome extensions are tampering with security headers
by vbezhenar on Wednesday May 26, 2021 @06:56AM
(#27288836)
Can you provide an example of the website which makes it impossible to insert JS from extension? I'd like to tinker with it. I wrote a simple extension which inserted JS to youtube and it worked just fine. I thought youtube is secure enough?
[ Parent
| on HN ]
Re:Chrome extensions are tampering with security headers
by qvq on Thursday May 27, 2021 @01:17AM
(#27299647)
For a Chrome extension using manifest V2: you can inject "inline" scripts into the DOM and interact with a page's JS regardless of the CSP.
For a Chrome extension using manifest v3: you can inject script tags with a src pointing to a local JS file in the extension regardless of the CSP.
Modifying the CSP is not a requirement for a Chrome extension to interact with a page's JS. I don't know about other browsers though.
Re:Chrome extensions are tampering with security headers
by Ajedi32 on Wednesday May 26, 2021 @11:20AM
(#27291662)
YouTube does not (currently) send CSP headers from what I can see in the dev tools. Hacker News does, but it specifies "unsafe-inline" which negates most of the protection. Not aware of any sites with more locked down policies off the top of my head; it's not exactly an advertised feature of most sites.
Re:Chrome extensions are tampering with security headers
by g3rv4 on Thursday May 27, 2021 @11:07PM
(#27311312)
slack. I do so with my extension[0]. At one point they rewrote it and added CSP.
In order to inject my code before theirs, I had to come up with different approaches on FF and Chrome... and since it was starting to become a cat and mouse game, I just took the extension private.
After that, they didn't escalate their game. I'm thankful for that, so that I can keep enjoying it without spending lots of time figuring out how to mess with it.