I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The reason why I am asking this question is because I am considering a threat model where there can be a malicious script running in the computer and trying to communicate with the app.

I am aware that browsers always put the ID of the extension in the "Origin" header of the websocket's handshake. However, that can be easily forged by a malicious script running outside of the browsers.

closed as off-topic by Polynomial, Tobi Nary, AJ Henderson, TheJulyPlot, Steve Aug 30 '17 at 15:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Polynomial, Tobi Nary, AJ Henderson, TheJulyPlot, Steve
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You're at the mercy of the hosting model. A script running on the machine has more privileges than the extension running in chrome. The script can bypass your extension entirely and just connect to the data and do whatever it wants without even thinking about touching chrome. – Steve Aug 31 '17 at 12:53