Enable cross origin requests blocked by CORS or CSP. Disable CORS and CSP in selected hostnames, preserve security of other websites

Latest Version

Version
0.0.7
Update
September 18, 2024
Size
42.35KiB
Developer
Category
Users
221
Rating
1 ★
Manifest Version
3
Web Store Status
Languages Support
English
See more
Permissions
DeclarativeNetRequest
Storage
Tabs
See more

Anti-CORS, anti-CSP Extension

The extension enables cross origin requests with fetch() or XMLHttpRequest (XHR) objects that are blocked by CORS policy or violate the document’s Content Security Policy. It is an easiest way to solve CORS errors during development.

Internally the extension bypasses Cross-Origin Resource Sharing (CORS) and Content Security Policy (CSP) by setting permissive Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers, Access-Control-Allow-Credentials and Content-Security-Policy response headers.

User guide:
Click the extension icon in the tab with the URL on which you want to enable cross-origin requests. CORS policy gets disabled in all the tabs with the same hostname. The tabs with web pages from other hosts are not affected. Any fetch() or XHR requests will succeed unless they are blocked by CSP. To disable CSP the pages have to be reloaded.

Typical use case:
You develop an enterprise web application whose functionality depends on already existing web services. The production environment has the same hostname as the web services, but the development environment is set up in your office and has a different hostname. The web services do not support the cross-origin requests. Thus, in the development environment HTTP requests to the essential web services are prevented by the CORS mechanism in the browser. You can imagine a solution based on a reverse proxy and the environment-dependent URLs for the REST services, or you can opt for the effortless solution not to do anything more than installing a browser extension.

Not only CORS, but also CSP prevents cross-origin requests. A strict CSP is an increasingly common security requirement. As with CORS, you could set up different policies for the development and production environment, but it is easier to use an extension instead of configuring environment-specific application settings.

How this extension is better than other extensions:
- The extension is domain-specific. Cross-origin requests gets enabled, i.e. CORS and CSP get disabled, not globally in all browser tabs, but only in the tabs with the hostnames that you have selected by clicking on the extension icon. Thus, the extension does not compromise the security of all websites opened in your browser.

- The extensions is open source and, thus, is safe.

- The extension relaxes both CORS and CSP.

- Cross origin requests with cookies are supported. The extension sets not an asterisk but the exact origin in the Access-Control-Allow-Origin header.

- The extension does not disrupt function of any popular websites such as Youtube.com or Google Docs

- The extension does not have any settings and does not need to be configured.

- Besides the icon, the extension does not have any user interface.

How to test a CORS extension
There are two criteria:
- Cross origin requests become possible. You can test all possible requests, i.e. GET, POST, PUT, DELETE, PATCH with or without credentials, on https://crossoriginrequests.onrender.com

- Function of other websites, e.g. youtube.com or docs.google.com, should not be disrupted even when the extension is activated in their tabs.

The source code of the anti-CORS extension is explained in https://marian-caikovski.medium.com/how-to-bypass-cors-and-csp-policies-and-enable-cross-origin-requests-in-a-browser-47fe269500fb

The plain source code can be extracted from the extension or downloaded from https://github.com/marianc000/antiCors
Read more

Source Manifest.json

{"update_url": "https://clients2.google.com/service/update2/crx", "name": "Anti-CORS, anti-CSP", "description": "Enable cross origin requests blocked by CORS or CSP. Disable CORS and CSP in selected hostnames, preserve security of other websites", "version": "0.0.7", "manifest_version": 3, "permissions": [ "declarativeNetRequest", "storage", "tabs" ], "optional_permissions":[], "optional_host_permissions": [ "" ], "background": { "service_worker": "sw/sw.js", "type":"module" }, "icons": { "128": "images/off.png" }, "options_ui": { "page": "options/options.html", "open_in_tab": true }, "action":{}, "key":"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgaMc5OcvbjumLEWwGvXRo9mk8IjZHPNn139pWRyoakX41IjWsIJs3SuMy2E4cEruH2s7iurejkquuey8f3KGiq/5VrNZKaE/z98zWKuHH1nDnBoxuW9h1Ho4lZruftvNho6/XBit+fyHrVozGsrnaV++2DbSLn8hrZ/FKghYw3ZTBQl+3/kxjpB7bgJ1glAg/GjzzrIIo7nDYL2qxtty+wjhP0kHNogVEqPjjuaywbUYdA9+RUV8iIZtgnl9fEFdbmHdIIN24SVBtGCZBKE3S3gm1ZcH9hTjqruqUtw4LczyAFibjVrDnl30BlZGhmDQtDIu6Y4MtIxm5MgPup4zTQIDAQAB"}
Read more

How to download and manually install Anti-CORS, anti-CSP extension for Chrome

Looking for a way to install Anti-CORS, anti-CSP extensions for Chrome, you can search for them in the Chrome Web Store, clicking the "Add to Chrome" button, and following the straightforward process.

However, you may need to install Anti-CORS, anti-CSP extensions manually, this article outlines two simple methods to effortlessly install Anti-CORS, anti-CSP extensions, whether they come as unpacked folders in compressed formats like .zip or as .crx files.

Method 1: Download Anti-CORS, anti-CSP extension and manually install through Drag &Drop

If you ever need to manually install a Anti-CORS, anti-CSP extension for Chrome, don't worry, it's a simple process. Just follow these easy steps, and you will have your extension ready to use in no time.

Step 1: Download the Anti-CORS, anti-CSP Extension by clicking the "Download CRX" button on the website.

Look for the Anti-CORS, anti-CSP extension you wish to install. Go to the website and download the Anti-CORS, anti-CSP extension package, which is usually a .CRX file and comes in a zipped file. Here ".crx" file is the format for Anti-CORS, anti-CSP extension that contains all the data.

Step 2: Extract &Arrange Files

Once the file is downloaded, extract that file into its own folder. Similarly, give that extension files a permanent home. In other words, keep it in a folder that you don't accidentally delete it because these files will be needed to make that extension work.

Step 3: Go to the Chrome Extensions Page

Open Google Chrome and in the address bar, type chrome://extensions; it will open the Google Chrome extensions page. Make sure that "My extensions" is selected in the sidebar.

Step 4: Drag and Drop the Extension

Now, go to the folder where you extracted the Anti-CORS, anti-CSP extension and drag &drop the extension file from there anywhere onto the extension page within Google Chrome.

Step 5: Complete the Installation

Once you drag and drop the extension file, follow the steps that Google Chrome takes you through. Similarly, if the extension file is of .crx file format, you will be required to review the permissions and then add the extension.

Now, you can manage that added extension as you would like to with any other Chrome extension that you added through Chrome Webstore. Its icon will also appear in the Google Chrome Menu on the right side of the address bar once you activate it.

Method 2: Download Anti-CORS, anti-CSP extension for Chrome and install in Developer Mode

This is another method to install Anti-CORS, anti-CSP extension manually, but the twist is that here, you install by enabling the developer mode option provided in Google Chrome. This mode is commonly used for testing extensions or running unpublished tools.

Step 1: Download the Anti-CORS, anti-CSP extension file

Select and download the Anti-CORS, anti-CSP extension by clicking the 'Download CRX' button on the website.

Step 2: Extract the downloaded contents

Convert the file to a ZIP file if it is in CRX format then extract the Anti-CORS, anti-CSP extension zip file or folder that you downloaded. Make sure you extract it using the same folder name and keep it safely in another folder, so you don't delete it by mistake. The extracted folder will be needed to keep your Anti-CORS, anti-CSP extension running.

Step 3: Open Chrome Extension Setting Page

In the address bar of Google Chrome, type chrome://extensions and open the Chrome Extension Page.

Step 4: Enable Developer Mode

After opening the Chrome Extension page, look at the top right side, and you will find the toggle option of "Developer mode."Simply enable that developer mode option.

Step 5: Load the Unpacked Extension

Once you enable the developer mode option, you will see the menu of Load Unpacked, Pack Extensions and Update. From that, select the option "Load unpacked."

Step 6: Select the Extension Folder

Once the pop-up opens upon clicking Load unpacked, select the Anti-CORS, anti-CSP extension directory and click on the "Select Folder "button.

Step 7: Confirm and Install

After you select an extension folder of a Google Chrome extension you're installing manually, confirm its installation for the final time and let the installation complete.

Conclusion

Here we've made a step-by-step guide on How to manually install Anti-CORS, anti-CSP extension in 2 ways. We hope this guide proves helpful.

Similar Extensions

icon

CORS Bypass Extension · Productivity 221 2 ★ 15.54KiB

icon

CORSet! Extension · Developer Tools 221 9 ★ 37.53KiB

icon

Cross Domain - CORS Extension · Developer Tools 221 65 ★ 121KiB

icon

Michael's Upgrade for TrakED Extension · Productivity 221 0 ★ 410KiB

icon

Anti FeR toolkit Extension · Fun 221 3 ★ 85.54KiB

icon

EASY CORS Extension · Developer Tools 221 19 ★ 55.17KiB

icon

Vind: Keyboard Shortcuts for Every Website Extension · Productivity 221 3 ★ 1.52MiB

icon

No CORS for swf Extension · Fun 221 1 ★ 3.63KiB

icon

Disable Content Security Policy Extension · Developer Tools 221 5 ★ 14.05KiB

icon

Apiary - Web Highlighter & Annotator Extension · Social & Communication 221 0 ★ 1.51MiB

icon

Cross-Origin-Fetch Extension · Developer Tools 221 0 ★ 32.05KiB

icon

Circle of Trust Extension · Social & Communication 221 0 ★ 3.62MiB

icon

LeadhuntAI - Chrome Extension Extension · Productivity 221 12 ★ 845KiB

icon

AI-MultiPrompt Extension · Productivity 221 0 ★ 253KiB

icon

JobJette - Free AI Job Search Copilot Extension · Productivity 221 1 ★ 1.2MiB

icon

CORS Unblock Extension · Developer Tools 221 6 ★ 12.65KiB

icon

Privci: Privacy Extension for Chrome Extension · Productivity 221 1 ★ 5.62MiB

icon

CSP Unblock Extension · Developer Tools 221 2 ★ 114KiB

icon

Datagator – claim back your privacy Extension · Productivity 221 4 ★ 1.6MiB

icon

Restfox CORS Helper Extension · Developer Tools 221 1 ★ 90.8KiB

icon

Allow CSP: Content-Security-Policy Extension · Developer Tools 221 2 ★ 49.95KiB

icon

Auditional Extension · Productivity 221 5 ★ 1.05MiB

icon

Ducking Extension - Ducking.id Extension · Productivity 221 13 ★ 1.88MiB

icon

tally.xlsdeal.com | CORS Extension · Productivity 221 1 ★ 276KiB