te')); return $arr; } /* 遍历用户所有主题 * @param $uid 用户ID * @param int $page 页数 * @param int $pagesize 每页记录条数 * @param bool $desc 排序方式 TRUE降序 FALSE升序 * @param string $key 返回的数组用那一列的值作为 key * @param array $col 查询哪些列 */ function thread_tid_find_by_uid($uid, $page = 1, $pagesize = 1000, $desc = TRUE, $key = 'tid', $col = array()) { if (empty($uid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('uid' => $uid), array('tid' => $orderby), $page, $pagesize, $key, $col); return $arr; } // 遍历栏目下tid 支持数组 $fid = array(1,2,3) function thread_tid_find_by_fid($fid, $page = 1, $pagesize = 1000, $desc = TRUE) { if (empty($fid)) return array(); $orderby = TRUE == $desc ? -1 : 1; $arr = thread_tid__find($cond = array('fid' => $fid), array('tid' => $orderby), $page, $pagesize, 'tid', array('tid', 'verify_date')); return $arr; } function thread_tid_delete($tid) { if (empty($tid)) return FALSE; $r = thread_tid__delete(array('tid' => $tid)); return $r; } function thread_tid_count() { $n = thread_tid__count(); return $n; } // 统计用户主题数 大数量下严谨使用非主键统计 function thread_uid_count($uid) { $n = thread_tid__count(array('uid' => $uid)); return $n; } // 统计栏目主题数 大数量下严谨使用非主键统计 function thread_fid_count($fid) { $n = thread_tid__count(array('fid' => $fid)); return $n; } ?>javascript - Chrome extension: best practise when it comes to authentication - Stack Overflow

科技改变生活-雨落星辰 - 所有的伟大,都源于一个勇敢的开始

    最新消息：雨落星辰是一个专注网站SEO优化、网站SEO诊断、搜索引擎研究、网络营销推广、网站策划运营及站长类的自媒体原创博客
    你的位置： 首页>programmer>javascript - Chrome extension: best practise when it comes to authentication - Stack Overflow

    javascript - Chrome extension: best practise when it comes to authentication - Stack Overflow

    programmeradmin3浏览0评论

    I'm developing a chrome extension based on Extension API and I need to authenticate against my own online service. I've read lots of documentation, I know that I need to use OAuth2 and that I should probably use chrome.identity.launchWebAuthFlow

    I managed to get login working using launchWebAuthFlow. The only problem is that it wants to authenticate even though I'm already logged in using a browser session. So extension's auth system is separated from the one in a browser.

    Extensions like Grammarly can detect whether I'm logged in Grammarly in a browser and adjust popup content based on that. From what I had a look at their source code, it seems like they're using cookies to detect the session. An extension can access cookies using 

    chrome.cookies.get({ url: 'http://localhost:8777', name: 'sessionid' },
    function (cookie) {
      if (cookie) {
        console.log(cookie.value);
      }
      else {
        console.log('Can\'t get cookie! Check the name!');
      }
    })

    Is this really the way Extension API works? Can't I use (IMHO) more secure Identity API and re-use browser session?

    I'm developing a chrome extension based on Extension API and I need to authenticate against my own online service. I've read lots of documentation, I know that I need to use OAuth2 and that I should probably use chrome.identity.launchWebAuthFlow https://developer.chrome./apps/app_identity#update_manifest

    I managed to get login working using launchWebAuthFlow. The only problem is that it wants to authenticate even though I'm already logged in using a browser session. So extension's auth system is separated from the one in a browser.

    Extensions like Grammarly can detect whether I'm logged in Grammarly in a browser and adjust popup content based on that. From what I had a look at their source code, it seems like they're using cookies to detect the session. An extension can access cookies using 

    chrome.cookies.get({ url: 'http://localhost:8777', name: 'sessionid' },
    function (cookie) {
      if (cookie) {
        console.log(cookie.value);
      }
      else {
        console.log('Can\'t get cookie! Check the name!');
      }
    })

    Is this really the way Extension API works? Can't I use (IMHO) more secure Identity API and re-use browser session?

    • javascript
    • google-chrome
    • google-chrome-extension
    Share Improve this question asked Sep 1, 2017 at 7:34 Jan VorcakJan Vorcak 20k15 gold badges56 silver badges90 bronze badges 7
    • 1 Maybe JWT tokens will suit you. I use it in couple extensions. – Denis L Commented Sep 1, 2017 at 8:25
    • Thanks for your ment @Deliaz, but can you please elaborate how exactly? I want to 'reuse' my browser session in my extension, so I would need to save JWT in cookies either way right? – Jan Vorcak Commented Sep 1, 2017 at 8:34
    • 2 Am I right that after login on your website you also want to see that you are signed in the extension? In this case, I guess, you can send a JWT token to the extension using External Message Passing (after succeeding auth, obviously). And you can put JWT to the cookies, but I prefer headers for that. – Denis L Commented Sep 1, 2017 at 9:28
    • It is not an answer or advice, just my thoughts. – Denis L Commented Sep 1, 2017 at 9:29
    • 1 @JanVorcak, could you please summarize what you ended up doing in the answer and post it here? It would be really helpful – Vladyslav Zavalykhatko Commented Feb 25, 2019 at 9:28
     |  Show 2 more ments

    2 Answers 2

    Reset to default 6

    The best practice for authentication is to manage it using cookies - this way, the web app and the extension can have a mon session.

    You would send the jwt token as a cookie with these options (javascript)

    {
        httpOnly: true,
        secure: process.env.NODE_ENV === 'production',
        maxAge: 1000 * 60 * 60 * 24 * 60, // 60 days,
        sameSite: 'None'
}

    (You might want to check your chrome://flags)

    And this cookie will automatically be stored for subsequent requests.

    In the client -

    You should create a new cookie variable.

            document.cookie = "signedin=true"

    import Cookies from 'js-cookie'

if(Cookies.get('signedin') {
  // ... redirect to dashboard
}
else {
  // ... show login
}

    Like you noticed, launchWebAuthFlow will not leverage your existing browser session. If you have the tabs permission, you can read the oauth grant from the window.title using urn:ietf:wg:oauth:2.0:oob:aut as your redirect URL. See my other answer for more information about it. This SA answer has example code.

    与本文相关的文章

    发布评论

    评论列表(0)

    1. 暂无评论