Taking signups through the extension itself?
Howdy folks I would like to know whether ya'll allow user signups through the extension itself?
I'm asking this because I see extensions redirecting users to an external website to signup for their service.
Is this a UX issue or are there security concerns when the signup form is inside an extension?
I have iframed stuff like login, which was acceptable to the reviewers. Then it is seamless experience, but allowing me to make immediate updates without approval by google. I added -enough- extension features to make it "not just be a wrapper" for a web app.
To give you concrete example, I have made this game which includes login functionality using FIrebase. I have packaged the game into
Of course there is a website. This is a whole big experiment to see how I can make one code base play with different distribution channels; among other things. It is also my first game and I'm pretty excited about it since it is a lot of fun to build :D
Anyway, so I think iframe is a viable option also, especially since you may want to be able to make changes fast.
Good stuff. You can easily port this to electron if you wanna try that too.
So CWS punishes developers who don't iframe their logins? Or you use iframe to load data from your servers to update the extension on the fly?
If you package the source code inside the extension, you will have to build an update, submit it for review, wait for google to approve it, and then wait for the change to propagate to client browsers over ~ 72 hours.
Imagine if there is some critical issue and you want to fix it asap. It will take a while if you have to go through all those steps and the code to update for all users.
If the code is remote and hosted on some web server (=iframe), you push an update to the server and everyone will see the change immediately.
You can choose either way, just that there is a difference in how that is handled in practice and how it will scale over time. I meant google is liberal in allowing you to choose.
The best strategy depends on the extension. For example I have another extension that handles 1M+ requests daily. I would not want to maintain that server load, but it is okay because all code is part of the extension so it runs on the user's machine; it can scale infinitely at zero cost to myself.
Yeah I'm aware of that. Apparently some big plugins such as grammarly update bits of code on the fly.
So if you use the iframe to login(and its hosted on your server), how do you pass back the cookie to the extension?
The extension can access the browser url; you can also use message passing; depends what you need for the api. If it is just auth token then it is just a string.
Ah yep I see.
I'd advise against using this style of message passing to extension -- this api is chrome only. Instead, inject into the page and pass messages that way -- page to inject, inject to background.
Good to know; I was not aware it was chrome only.
Hey Shash,
I was working on one of my existing extensions to add login and payments. I was easily able to setup google based login via firebase. In fact firebase website has a small section to implement login on chrome extensions so you could use that.
I had to move to an external website approach because I was not able to get stripe working.
The only thing to note is that login/payments etc will have to be done on the background script side code and not on the content script side. Also, you need to provide configuration URLs for auth, which will have to be chrome-extension://your-ext-id
Yeah I don't mind moving to another website for payments. But its good as long as there are no technical barriers in doing signups from the extension.