Can a Firefox addon's Internal UUID value be made stable?

Question

I'm referring to the "Internal UUID" value that's visible in about:debugging, which is different from the extension ID that is specified in manifest.json for web extensions.

In my testing, this is a different value for each installation of the addon.

I'd like to set this to a predictable value because it is used as the origin (e.g. moz-extension://guid) for communication APIs like postMessage. It'd be a good indicator for whether a message received by a web app is from an authorized extension vs. some other extension or page.

In Chrome, the origin seems to be stable across different installations of an extension, so I'd like to see if it's possible to achieve the same thing with Firefox.

Sillsby

did you ever achieve this? – Casiecasilda

Answer 1

The internal UUID is deliberately created per installation of an extension, to avoid fingerprinting, you can see a longer discussion at https://bugzil.la/1372288

However, I think you're misunderstanding the purpose of the Origin header, it lets your web app and browser work together to prevent a class of cross-site scripting attacks. But by itself, it doesn't really give your web app a reliable indicator of the origin of the request (that is, any non-browser client can easily construct an HTTP request with an arbitrary value in the Origin header)

Banjermasin

OK, so not only is it unlikely to be deterministic per extension, it may eventually be nondeterministic per session. – Sillsby

It would be a convenient way to have a communication channel between a web app's user session and an authorized extension, but it makes sense that privacy concerns should take precedence. I'll look at other ways to authorize the extension (OAuth perhaps). Thanks for the reply. – Sillsby

"and an authorized extension" - don't try to "authorize" code, that ultimately amounts to an attempt to implement DRM. Authorize the user (via tokens or similar). – Theogony