Davoguha/bookmarks-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document who can call the loopback API and let the user pick the listen port.

Browse Source
This commit is contained in:
alexveley
2026-09-22 08:19:12 -04:00
parent cfda629418
commit 33944dbd07
10 changed files with 184 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+1 -1
View File
@@ -6,7 +6,7 @@ This add-on is scoped to bookmarks. Treat a leaked `fab_…` secret like a passw
- Manifest permissions: `bookmarks`, `storage`, `nativeMessaging` only
- No `tabs`, `history`, `cookies`, `<all_urls>`, `webRequest`, or `runtime.onMessageExternal`
- Host bind: `127.0.0.1`
- Host bind: `127.0.0.1` (port defaults to 17634; user-configurable)
- Reject HTTP requests that carry a browser `Origin`
- Native host `allowed_extensions` pinned to this gecko id
- Method allowlist in both `extension/background.js` and `host/firefox_agent_bridge_host.py`