I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with the user's fb content and sometimes send requests to the web service.
How would it be possible to secure the web service to make sure that the messages comes only from the extension? I want to avoid any messages that is send by a third party claiming to be the original user.