I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with the user's fb content and sometimes send requests to the web service.

How would it be possible to secure the web service to make sure that the messages comes only from the extension? I want to avoid any messages that is send by a third party claiming to be the original user.

2 Answers 2


It's not possible to prevent a user from spoofing requests. Your framework should be such that spoofed requests sent by a user should not matter. For example, I can spoof comment POST requests all I want to Facebook, and I'll just get a bunch of comments. There are no only client-side restrictions preventing me from doing something I'm not supposed to do. I can't post to a closed group by modifying the group ID in a POST request. The server will just block the request. If you don't want your users to be able to do something, block it on the server side.

However, what you can do is use a good user authentication system to prevent a user from spoofing another user's request. Either connect to OpenID, or use a persistent session cookie(to avoid asking the user to authenticate every time) and your own authentication. THis will prevent a user from spoofing another user's request.

  • +1 for the last paragraph. The only way to prevent abuse is the use of an external authenticator. developer.chrome.com/extensions/tut_oauth.html
    – Rob W
    Commented Jul 1, 2013 at 9:45
  • @RobW There's no need for external, it just needs to be a reliable authentication mechanism (Using a session cookie from a well-known web framework: good. Creating your own session cookie generator : not good). Commented Jul 1, 2013 at 9:48
  • So, sending access token of facebook via HTTPS to authenticate the user would secure it?
    – M-T-A
    Commented Jul 1, 2013 at 22:51
  • @m-t-a yep, that would work. Commented Jul 2, 2013 at 1:33
  • I can't vote up, but I selected it as best answer ;)
    – M-T-A
    Commented Jul 2, 2013 at 8:26


I can take your extension sourcecode and spoof any request I want. I can even change the content of your extension (Chrome extensions are basically Javascript, therefore it's way easier than patching binary code) and then let the extension do whatever I want.

You should never rely on code running on the clientside. Every checksum, shared secret or anything else can be spoofed when the attacker has access to the code and configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .