I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The reason why I am asking this question is because I am considering a threat model where there can be a malicious script running in the computer and trying to communicate with the app.

I am aware that browsers always put the ID of the extension in the "Origin" header of the websocket's handshake. However, that can be easily forged by a malicious script running outside of the browsers.

  • You're at the mercy of the hosting model. A script running on the machine has more privileges than the extension running in chrome. The script can bypass your extension entirely and just connect to the data and do whatever it wants without even thinking about touching chrome. – Steve Aug 31 '17 at 12:53