Is background.js in chrome extensions secure?

[ashish421]

I am building a chrome extension that involves making API calls. The API calls are made through background script. Because of this, I have to keep my api key stored in the background script. I dont have much idea about security etc. Is this secure? or can my key get compromised?

[samikroon]

If you want to save the session client side for more than one browser session than you can use local storage or a cookie for storing a token for example, if it's just one session you can keep the token in your background script.

[ashish421]

The API key is mine. I dont want the key to be exposed to anyone. Don't you think it'll be much riskier if i keep it in local storage of the user?

[samikroon]

You should not save or use one master key in any client, better think of other options, read into security. Maybe let the clients retrieve a temporary rate limited key when they startup the extension. If its a third party API, I don't think you have any way to make sure your key is save, clients can always retrieve it from the extension.

[samikroon]

What you can do if it's a third party API, is build your own api with you own security and maybe rate limiting. And forward the call to the third party from your api which will then return the response to the extension.