Hacker News Reader

Comment by pjc50 | Hacker News Reader

Wait, under what circumstances are browser extensions allowed to communicate with anything outside the browser?

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

It was basically built so password manager extensions could communicate with password manager apps to do things like yubikey support etc. before browsers started handling webauthn

Oh wow, this is cool. Yep this would make USB Serial work on Firefox with a simple extension.

Extension + a native program for the extension to talk to. The native program has to manage accessing the usb device and providing an interface to the browser extension.

Yes, I have done this for (a fraction of) WebBluetooth. Albeit the extension API does not make it easy, and i don't know if you can implement the entire Web* API surface, but at least it is good enough for proofs of concept.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...

But more generally you can just run webserver on 127.0.0.1 and interact with it from extension (although I didn't test this particular use-case, it works fine from website, but extension might have its own nuances).

The latter poses some security problems, though, which the native messaging API avoids (e.g. random websites being able to connect to the native application and pretending to be your extension).

When random websites connect to your application, you can (and should) inspect Referer header and filter out unwanted ones.

Reply on news.ycombinator.com