Is it safe to use the prompt() function from a Chrome Extension to ask for a password?

user_6262124 0
Viewed 232

I am developing a small extension, and to ease my job, I'd like to use

prompt("enter password");

so that the user can enter his/her password. I know the prompt will show the password as plain text but what are some other security problems? Can other websites have access to the content of this prompt(which would be a huge deal in this case)?

google-chrome-extension security javascript
2 Answers

If you aren't worried about the entered text being displayed without ***s, then it looks fine. It'll be as safe as pretty much any other JS handling of passwords.

Can other websites have access to the content of this prompt

If it's a content script, they could, if they intercepted the window.prompt and overwrote it with their own implementation, eg:

// page script:
const originalPrompt = window.prompt;
window.prompt = (text) => {
  const result = originalPrompt(text);
  // HERE, the page can do something malicious with the result
  // such as sending it to their server
  console.log('Page detected:', result);
  return result;
};


// Your script:

prompt('Password?');

But this approach would compromise pretty much any handling of passwords on the front-end - it's not an issue with the prompt, but with the front-end in general.

To get around this problem in a content script, make sure that the prompt that you call is the native code version, which can only be done in a foolproof way by running your code before any other code on the page runs. Save a reference to the original prompt on document_start.

Also, make sure to do the validation on the backend, not the frontend. If your JS is like

const userInput = prompt("enter password");
if (userInput !== 'theTruePassword') {
  // wrong
  return;
}
// do stuff

then it would be trivial for anyone with access to the website to bypass the password check and get to the do stuff by examining the source code. Instead, make sure to send the password to a server and have the server validate whether it's correct, then have the server send the sensitive information back to the client.

user_95152070

I wont recommend using prompt so here's a little code that you can modify to show your contents after the correct password has been set

<!DOCTYPE html>
<html>
   <body>
      <label>enter your pin :</label>
            <input type="text" id="pin" name="pin"><br>
    <br>
            <button id="mybutton" onclick="myfunction()">enter</button>
            <p id="demo"></p>
            <script type="text/javascript">
              function myfunction() 
              {
                if ((document.getElementById("pin").value)=="4567") 
                    document.getElementById("demo").innerHTML = "you have the correct password"
                else
                    alert("incorrect password")
               }
            </script>
   </body>
</html>

You can also change the passcode that I has set to anything you want

user_152969210
Related