在 Chrome 扩展中安全地存储 Django REST API 令牌

Question

I'm making a Chrome extension which should allow users to enter their username and password into a pop-up interface, post those to the server via AJAX, and receive a Django REST API token which the Chrome extension can use to interact with the Django app (get user info, create new records, etc. - so it should be secure).

Right now I've got the Chrome extension making the request and receiving the API token, but I'm struggling with how to store the API token securely.

I know that chrome.storage is out because the docs say that it's not secure. Would it be possible to use cookies here? The extension needs to run on multiple domains, so I'm not sure if I can use cookies securely.

I'd like to not require the user to log in every time they use Chrome, but I'm not sure how to go about storing the API data.

Answer 1

You should use chrome.identity :

Developers can leverage chrome.identity API to store user credentials. A Chrome extension usually makes API requests to external resources. A best practice is to store an OAuth API token. Such tokens can perform authorized requests on behalf of users without user names / passwords, and can be revoked by the user anytime.

Chrome API provides a chrome.identity service, which provides a secure way for an extension to authenticate, fetch and refresh tokens. This API enables a user to perform authentication against a third-party service. Chrome can interactively display a popup UI, which:

Here's the official docs .

Answer 2

Chrome does not allow extensions to modify/deal with cookies.

In the documentation it says: "Use the Chrome Identity API to authenticate users: the getAuthToken for users logged into their Google Account and the launchWebAuthFlow for users logged into a non-Google account. If your app uses its own server to authenticate users, you will need to use the latter "

You can find the documentation about non-Google accounts here .

You can store your token in local storage which is only accessible by your extension but be aware that, it is not encrypted and can be seen through Chrome's development tools.