Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ipfs-companion chrome extension id to accepted origins for future manifest v3 version #8689

Closed
meandavejustice opened this issue Jan 21, 2022 · 1 comment · Fixed by #8690
Closed

Add ipfs-companion chrome extension id to accepted origins for future manifest v3 version #8689

meandavejustice opened this issue Jan 21, 2022 · 1 comment · Fixed by #8690
Assignees
@lidel @meandavejustice
Labels
effort/hours Estimated to take one or several hours kind/maintenance Work required to avoid breaking changes or harm to project's status quo P1 High: Likely tackled by core team if no one steps up topic/rpc-api Issues related to Kubo RPC API at /api/v0
Milestone
Best Effort Track

Comments

@meandavejustice
Copy link
Contributor

meandavejustice commented Jan 21, 2022 •
edited by lidel
Loading

Manifest v3 removes support for the blocking webRequest api. We are currently using this api to intercept requests and modify the Origin URL to that of the ipfs-webui. With support for this feature gone we need another way for companion to make api requests to ipfs.

I'm proposing that we add the chrome-extension-id (which is generated once on upload to the chrome web store) to the default allowed origins. This way companion can still be useful for users when manifest v2 is deprecated, and they will not have to manually update their configurations.

I have discussed this a bit with @lidel on slack, but wanted to get the ball rolling here so that we can have the ability to get ipfs-companion manifest v3 into the chrome store (if only as a beta channel for power users) by the end of Q1.

For further context: ipfs/ipfs-companion#666 (mv3 tracking issues)
@meandavejustice meandavejustice added the kind/enhancement A net-new feature or improvement to an existing feature label Jan 21, 2022
@ipfs ipfs deleted a comment from welcome bot Jan 21, 2022
@lidel
Copy link
Member

lidel commented Jan 21, 2022 •
edited
Loading

  • SGTM, this should work for Chromium-based browsers (Google Chrome, Brave, Opera, Edge)
  • Caveats (all fixable, i think)
    • There may be a regression if user has a custom list of allowed origins (making this check fail). This means Companion not working for those folks
      • TBD: I think we may adjust the behavior to always append defaultSafelistedOrigins and skip it only when set to null, but we will decide this detail when a PR is open and we can see behavior in real world (I have no trust in browser extension specs-vs-implementation around CORS and localhost, seen many bugs over the years)
    • Need to figure out something else for Firefox (which anonymizes extension ids per user)
      • We've discussed this and if Firefox will allow blocking webRequest APIs in Manifest V3, then we could keep the Origin fixup we use right now in V2

Extension IDs from Chrome Web Store:

@meandavejustice feel free to open a PR that adds their Origin URLs to defaultLocalhostOrigins, we will iterate on details there :)

@lidel lidel added the P1 High: Likely tackled by core team if no one steps up label Jan 21, 2022
@lidel lidel added effort/hours Estimated to take one or several hours kind/maintenance Work required to avoid breaking changes or harm to project's status quo topic/rpc-api Issues related to Kubo RPC API at /api/v0 and removed kind/enhancement A net-new feature or improvement to an existing feature labels Jan 21, 2022
meandavejustice added a commit to meandavejustice/kubo that referenced this issue Jan 21, 2022
@meandavejustice
fix: add companion ids to allow origins
a565133 
- fixes ipfs#8689
- Adds the chrome-extension ids for ipfs-companion and
ipfs-companion-beta to the allowed origins list, this
allows us to accesss ipfs api from a manifest v3 extension.
- added tests in t0401-api-browser-security.sh
@meandavejustice meandavejustice mentioned this issue Jan 21, 2022
Merged
@BigLep BigLep added this to the Best Effort Track milestone Mar 10, 2022
meandavejustice added a commit to meandavejustice/kubo that referenced this issue Mar 16, 2022
@meandavejustice
fix: add companion ids to allow origins
7978e05 
- fixes ipfs#8689
- Adds the chrome-extension ids for ipfs-companion and
ipfs-companion-beta to the allowed origins list, this
allows us to accesss ipfs api from a manifest v3 extension.
- added tests in t0401-api-browser-security.sh
meandavejustice added a commit to meandavejustice/kubo that referenced this issue Mar 16, 2022
@meandavejustice
fix: add companion ids to allow origins
c48b612 
- fixes ipfs#8689
- Adds the chrome-extension ids for ipfs-companion and
ipfs-companion-beta to the allowed origins list, this
allows us to accesss ipfs api from a manifest v3 extension.
- added tests in t0401-api-browser-security.sh
lidel added a commit that referenced this issue Mar 16, 2022
@meandavejustice @lidel
fix: allow ipfs-companion browser extension to access RPC API (#8690)
6774ef9 
* fix: add companion ids to allow origins

- fixes #8689
- Adds the chrome-extension ids for ipfs-companion and
ipfs-companion-beta to the allowed origins list, this
allows us to accesss ipfs api from a manifest v3 extension.
- added tests in t0401-api-browser-security.sh

* fix: companion when custom CORS *-Origin is set

Companion extension should be able to access RPC API even when custom
Access-Control-Allow-Origin is set

Co-authored-by: Marcin Rataj <lidel@lidel.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lidel lidel

@meandavejustice meandavejustice

Labels
effort/hours Estimated to take one or several hours kind/maintenance Work required to avoid breaking changes or harm to project's status quo P1 High: Likely tackled by core team if no one steps up topic/rpc-api Issues related to Kubo RPC API at /api/v0
Projects
No open projects
IPFS Shipyard Team
Archived in project
Milestone
Best Effort Track
Development

Successfully merging a pull request may close this issue.

fix: allow ipfs-companion browser extension to access RPC API meandavejustice/kubo
3 participants
@BigLep @lidel @meandavejustice