As a web developer, is there any way to prevent a user's Chrome extensions from being applied to my site? i.e. a header, meta tag, anything? Additionally, if there is, is there also a way to whitelist particular extensions?
-
4I don't mean to be the jerk who naysays versus providing an answer, but is there a compelling reason you want to do this? If a user has installed certain extensions one would assume that they'd like them to work properly.– vpiTriumphApr 22, 2012 at 3:27
-
11If there were a way to do this, every site would disallow adBlock. I don't think it's possible.– Craig OApr 22, 2012 at 3:31
-
@vpiTriumph well, for security reasons. I'm trying to be "extra careful" in creating a secure webapp, but that sort of goes out the window if any (malicious) extension can just scrape the page and AJAX it off to some random server.– MaxApr 22, 2012 at 3:59
-
@CraigO that does seem rather probable, huh. Maybe it's in Google's own best interest to implement extension-blocking :P– MaxApr 22, 2012 at 4:00
-
1@Max I understand the thought process, but even the built in developer tools in IE let you make arbitrary JavaScript calls. I guess what I'm getting at is that even though certain extensions can potentially make the inner workings of your site more transparent, ultimately your solution is going to be writing a secure web application and diligently following best practices rather than disabling extensions. With all that being said, I think the adblock example is anecdotal evidence that it may not be possible in any case :D.– vpiTriumphApr 22, 2012 at 4:14
2 Answers
It's not possible. At the web server end, you are only only able to control what the browser will allow you to control. In simple terms, this means you can control the data (HTML, javascript, headers etc) that you send back to it. That's about it.
Can't you create a Content Security Policy (CSP) and block inline javascript and only allow javascript from specific domains? You could even create a CSP in report-only mode and collect violation reports via something like https://report-uri.io/
-
2Extensions mostly don't care about CSP. Content scripts and inline code injected by them into the page explicitly bypass it.– XanSep 18, 2017 at 13:47
-
-
1Based on this article, it looks like a CSP can block extensions, but extensions also have the ability to modify your CSP any way they like.– lobatiAug 26, 2019 at 22:30