search

hypertrons / hypertrons-crx

A browser extension for insights into GitHub, Gitee projects and developers.
https://hypercrx.cn
Apache License 2.0
357 stars 102 forks source link

[Discussion] Is there any secure way to request data for Chrome extension? #380

Closed frank-zsy closed 2 years ago

frank-zsy commented 2 years ago

Description

Right now, the extension will request a public data resource to display the diagrams.

Is there any secure way to request private data? Like if we want to add personal recommendations in the future, we may not want the data to be in the public domain.

tyn1998 commented 2 years ago

Hi, @frank-zsy, does it mean that we need a backend server?

frank-zsy commented 2 years ago

No matter what the mechanism is, assume that we have a backend server, how can we control the data if we don't have an account system and need login in frontend?

tyn1998 commented 2 years ago

Maybe we can use jQuery to get loginId:

image

An existing example:

https://github.com/hypertrons/hypertrons-crx/blob/43e1ed45aaf051a65a7708e3a60bbaf0926c012f/src/pages/ContentScripts/DeveloperNetwork.tsx#L374-L384

tyn1998 commented 2 years ago

Is there any secure way to request private data?

Oh I didn't consider this requirement.

frank-zsy commented 2 years ago

Yes, we can get the login user, but we can not control the data. Even we set the cross domain settings, the data is still available to public and get by request, although they can not directly use the data in web page.

frank-zsy commented 2 years ago

As there are more implementations of CHAOSS metrics in OpenDigger, I am considering add more data to Hypercrx. If we have no way to handle private data, I will design to use public data first.