I'm creating a chrome extension and already have a website running. I want to authenticate my extension using my website on which the user is already authenticated.
Now, my understanding is, I can exchange information betwen my website and my extension using window.postMessage and window.addEventListener, but what is unclear to me is the following:
How do I check if the message was infact send from my extension and is not a forged request?
I would invoke the chrome extension to open a unique URL which is generated to authenticate the user.
This is the same concept as the password reset by email with only a link
Also make sure that the URL has an expiry date something like 2 minutes.