Code for syncing state with Kagi Privacy Pass extension #12
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This extension makes the browser send a custom X-Kagi-Authorization header
to kagi.com, to authenticate users even when using incognito mode.
This can enter a "race condition" with the Kagi Privacy Pass extension,
which strips all de-anonymising information sent to kagi.com, such as X-Kagi-Authorization,
whenever "Privacy Pass mode" is in use.
To avoid this race, we let the two extensions communicate, so that this extenesion removes
(respectively, adds) the header when "Privacy Pass mode" is active (respectively, "PP mode"
is inactive or the other extension is not installed/enabled).
We achieve this syncronization with a simple messaging protocol outlined below:
The Privacy Pass extension will send this extension single messages:
Due to Chromium extension limitations, it cannot send a message when uninstalled/deactivated.
The main extension (this one) keeps track of whether the "PP mode" is acrive or not by keeping state.
This state is updated by the following actions:
Having both extensions send / request the "PP mode" status allows for the following:
There is one limitation, due to the PP extension being unable to signal to this one that it was uninstalled.
This means that in theory, one could have a scenario where first PP mode is enabled, this extension removes
X-Kagi-Authorization, and then the PP extension is uninstalled. In Incognito mode, where the kagi_session
cookie is not sent by the browser, this would cause failed authentication with Kagi.
Possible solutions:
but it means adding an extra new tab on uninstall.
Polling only when applying the header is not sufficient (as the PP extension could be uninstalled without
webRequest.onComplete being triggered).
In practice neither of these solutions seems necessary. Instead, we have this extension poll the PP extension every
time it checks whether to apply the header. This means that even in the case where the PP extension is uninstalled while
PP mode was set on, at most one query to kagi.com will fail to authenticate. Such query will then trigger webRequest.onComplete,
which will then find out the PP extension was uninstalled, and hence reinstate X-Kagi-Authorize.