What cookies a Chrome extension cannot use in network requests

Can an extension establish a session with a back end server? What it means for unaware users?

Marian Čaikovski
3 min readApr 6, 2024

Can a Chrome extension to make use of cookies? Can an extension maintain a session with a backend server? Are cookies included when an extension uses fetch() to make a network request?

The official documentation includes a succinct explanation about cookies in requests from an extension:

Requests from an extension to a third-party are treated as same-site.

I think this feature is remarkable and is good to see. Basically a browser extension is easily capable of impersonating a user on any website without the knowledge of the user.

I deployed on the Google App Engine a simple Java application that upon any HTTP request returns a string with the received request URL, origin and cookies, and the internal session id.

Just in case, to additionally test the effect of the very useful SameSite attribute, the application also sets a cookie for each possible value of SameSite: Strict, Lax, None.

--

--

Marian Čaikovski

Java, JavaScript and SQL developer. Interested in data collection and visualization.