Hacker News Reader

Yeah, I keep having issues with CORS headers in Firefox and then it becomes really hard to pinpoint which extension caused what.

I may be wrong but it didn't used to be like that. It's a sideeffect of the whole webextension concept no?

View on HN

Maybe? I vaguely remember webextensions not needing to do this. But I can't say that with certainty, because it might be that most websites didn't enable CORS so I never noticed, or I could just have the timeline mixed up in my head.

I don't think anything about webextensions requires this problem to exist. So if it is a problem with webextensions, it's a problem we've "chosen" to have. And browsers could fix this without drastically overhauling anything with extensions.

But I can not stress enough how much out of my depth I am commenting on this, my full knowledge is basically a couple days worth of research a year or two ago and some interaction on a bug report.

Any proper implementation of the cors eval/script constraints would block extension script injection, regardless of whether webextensions are used. You'd have to run code outside of the page context, which automatically poses issues since the page is probably in another process.

The problem is that the extension can alter or fully remove the cors headers before it injects scripts, neutering even the best configuration.

Reply on news.ycombinator.com