Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with the user's fb content and sometimes send requests to the web service.

How would it be possible to secure the web service to make sure that the messages comes only from the extension? I want to avoid any messages that is send by a third party claiming to be the original user.

share|improve this question
up vote 2 down vote accepted

It's not possible to prevent a user from spoofing requests. Your framework should be such that spoofed requests sent by a user should not matter. For example, I can spoof comment POST requests all I want to Facebook, and I'll just get a bunch of comments. There are no only client-side restrictions preventing me from doing something I'm not supposed to do. I can't post to a closed group by modifying the group ID in a POST request. The server will just block the request. If you don't want your users to be able to do something, block it on the server side.

However, what you can do is use a good user authentication system to prevent a user from spoofing another user's request. Either connect to OpenID, or use a persistent session cookie(to avoid asking the user to authenticate every time) and your own authentication. THis will prevent a user from spoofing another user's request.

share|improve this answer
+1 for the last paragraph. The only way to prevent abuse is the use of an external authenticator. – Rob W Jul 1 '13 at 9:45
@RobW There's no need for external, it just needs to be a reliable authentication mechanism (Using a session cookie from a well-known web framework: good. Creating your own session cookie generator : not good). – Manishearth Jul 1 '13 at 9:48
So, sending access token of facebook via HTTPS to authenticate the user would secure it? – M-T-A Jul 1 '13 at 22:51
@m-t-a yep, that would work. – Manishearth Jul 2 '13 at 1:33
I can't vote up, but I selected it as best answer ;) – M-T-A Jul 2 '13 at 8:26


I can take your extension sourcecode and spoof any request I want. I can even change the content of your extension (Chrome extensions are basically Javascript, therefore it's way easier than patching binary code) and then let the extension do whatever I want.

You should never rely on code running on the clientside. Every checksum, shared secret or anything else can be spoofed when the attacker has access to the code and configuration.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.