958390 - Add on is capable of injecting/modifying Options request, origin header for cors preflight

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[serg.gorbaty]

Attachment: image.jpg

User Agent: Mozilla/5.0 (iPad; CPU OS 7_0_4 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B554a Safari/9537.53

Steps to reproduce:

1. Install an extension such as modify headers
2. Configure to modify origin header on every request in the installed add on to 'http://sergey.test.com' or what have you
3. Visit a page that uses cors with preflight 
(You can run locally this project is good enough https://github.com/osmlab/osm-auth/blob/gh-pages/index.html)
4. Open network console in ff
5. If you used the sample project from step 3, hit authenticate button, otherwise, initiate cors request from your app



Actual results:

Observe in network pane an options request with modified origin header that does not match the domain it originated from.


Expected results:

JavaScript doesnt have access to options header, extension should not need to either.
Latest chrome does not exhibit this behavior.

Comment 1

[Daniel Veditz [:dveditz]]

Firefox addons are quite a bit more powerful than Chrome extensions by design, for good and ill. There is no separation between what is "Firefox" and what is "Addon" once you've got them installed.