search

cliqz-oss / re-consent

Consent-management browser extension
https://cliqz.com/en/magazine/re-consent
Mozilla Public License 2.0
106 stars 16 forks source link

Prevent extension UUID leak via Origin on Firefox. #8

Closed sammacbeth closed 5 years ago

sammacbeth commented 5 years ago

On Firefox fetch requests have a Origin header attached which contains a unique value (Bugzilla Issue). When the extension is fetching privacy settings for google and facebook, this header is included, and could be used by google/facebook for linking accounts or sessions.

This PR fixes the issue by using XMLHttpRequest for fetching these pages instead of fetch. Once Firefox 64 is release this should be fixed and we can revert this change.

cc @konark-cliqz