For your next side project, make a browser extension

Re:For your next side project, make a browser extension by cdrini on Sunday January 15, 2023 @05:33PM (#34394343)

Odd! Were you trying to fetch a public, CORS-enabled API? That should just work. If you were trying to make a network request for a non-CORS endpoint (eg fetch the google homepage or something), you'll need to add the domain to your permissions section.

Eg:

"permission": [ "storage", "https://google.com" ]

[ Parent | on HN ]

Re:For your next side project, make a browser extension by old_hat on Sunday January 15, 2023 @06:11PM (#34394693)

Not OP, I built an extension for a site that sent CSP headers. Because the browser extension wasn't allowed in the list of JS sources, it all borked.

Not certain that's this user's issue, but that is another thing to check.

[ Parent | on HN ]

Re:For your next side project, make a browser extension by jakear on Sunday January 15, 2023 @09:14PM (#34395996)

I suspect this is it. There were a lot of things logged to console for twitter violating its own CSP, but I didn’t see any for my script.

It seems the overall handling of network errors in add-ons has a lot of room for improvement.

It should be noted that chromium allows the network request regardless of the CSP. This is the correct, User-Empowering approach. Firefox’s deference to the Origin to control the code the User is attempting to run is the antithesis of what a User Agent ought to be.

[ Parent | on HN ]

Re:For your next side project, make a browser extension by jakear on Sunday January 15, 2023 @09:19PM (#34396034)

I have CORS configured to allow the https//twitter.com/ origin. I could see firefox perhaps using a different origin for worker scripts? But hard to tell since the network tab doesn’t show any of the requests.

I could set up server logs locally, but there’s only so many hours in my life.

[ Parent | on HN ]