Trying to build browsers extensions without an api

In my extension, I’m doing something pretty similar. In my background.js I set a browser.browserAction.onClicked listener where the key part is:

browser.tabs.create({
        "url": "https://podqueue.fm/add_url/extension/" + apikey_string + encoded_url
      });

You should be able to change this to browser.tabs.update to update the current tab URL instead of opening a new tab. Make sure you have the correct permissions declared in your manifest as well, you’ll likely need tabs and/or activeTab for this.

By the way, you may want to add some sort of protection to that endpoint (you can see I use a pre-shared per-user “API key”), because otherwise someone will likely be able to use a CSRF attack to add links unless you have a manual interactive link confirmation by the user as an extra step.

Say something nice to skatkov…

2
In my extension, I’m doing something pretty similar. In my background.js I set a browser.browserAction.onClicked listener where the key part is:
```
browser.tabs.create({
        "url": "https://podqueue.fm/add_url/extension/" + apikey_string + encoded_url
      });
```
You should be able to change this to browser.tabs.update to update the current tab URL instead of opening a new tab. Make sure you have the correct permissions declared in your manifest as well, you’ll likely need tabs and/or activeTab for this.

By the way, you may want to add some sort of protection to that endpoint (you can see I use a pre-shared per-user “API key”), because otherwise someone will likely be able to use a CSRF attack to add links unless you have a manual interactive link confirmation by the user as an extra step.
ryanfb

·
5 years ago
·