I've developed a Chrome extension that I plan to publish to the Chrome Web Store.

On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of application ID and secrets (similar to how Facebook does it) that is exposed via a private API.

The extension has an application ID embedded inside it along with an application secret that it will first use to request for an access token. I use the application ID to ensure the request is coming from my chrome extension and not elsewhere. Of course, I do understand this can be spoofed, so, I do have rate limiting in place.

But, I was wondering, how do I actually secure my API in this case? In particular, if my application secrets can be easily reverse engineered from the chrome extension. And are there still any benefits to having a refresh token mechanism in place?

How do popular companies achieve this?

Thank you

  • its the same as a web site's API usage; the benefits and pitfalls are the same even if the "site" is invisible to the normal user. – dandavis Jan 22 '19 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.