Is there any best practice to implement session login that prevents third-party plugins/extensions send requests to the server?

I see cookies with httpOnly flag can prevent javascript interaction, along with sameSite flag can mitigate cross-site attacks, but what about the browser plugins/extensions?

Some plugins/extensions can call fetch inside their code, and httpOnly cookies are auto sent by fetch if the credentials are set to include, so any plugins/extensions that create a fetch with credential included, can request to the server to manipulate user data?

# some_bad_plugin.js

fetch(YOUR_SERVER_URL, {
  method: 'GET',
  credentials: 'include',
})

I think this problem may be mitigated by additional login information stored in cookie or localStorage, and the request to the server need these fields. But that seems back to the beginning with no httpOnly cookie...

Is there something I missed?