如何安全地识别http请求中的chrome扩展名？

Question

I am trying to send a ajax request to a web server from a chrome extension. In the backend I am trying to identify that the request came from that extension and that extension only.

I could send the request with a specific key, but anyone who looks into the extension can view that key and attempt to send requests to my server in other ways outside the extension.

I'm wondering if there is some secure id that an extension will have that can't be accessed by viewing the extension source files.

Or is there other ways i can secure this http requests?

Any ideas?

Answer 1

I'm wondering if there is some secure id that an extension will have that can't be accessed by viewing the extension source files.

Basically, no - even if you could somehow obfuscate a token in the code, it would still be trivial to inspect by using Dev Tools to examine the final network request.