Member Avatar for Yasaswi_1

Hello guys!
This is my first question on codeproject. Please forgive me if I had not provided all the necessary details in my question. I'm working on my college project which is a chrome extension. We've already stored the name of the website, username, and password in MySQL data type. The requirement now is - if the user opens a site like Facebook and enters the username and if the details of his are already stored in the database, then I must be able to fill the password field of the website. This extension is currently being developed only using HTML, javascript and PHP. So, if possible, I would want you all to help me solve my issue using the above mentioned languages only. Any frameworks can also be mentioned but the learning curve must not be too steep since I don't have much time left to be able to learn much. Please help me.

username <input type="text"  onclick="myFunction()">
password <input type="password"id = "1"  name="name" >

<script>
function myFunction()
{   
    document.getElementById("1").value = "Get Password";
}
</script>

I know how to update the password field in my webpage but, please guide me on how to do this in any other site.

  • 3 Contributors
  • 4 Replies
  • 383 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

A short, practical summary that fills gaps in the thread and points to a safe, working pattern.

It is possible to auto-fill other sites from an extension, but not without risk. Chrome extensions are built with HTML/CSS/JavaScript (not Java) and use content scripts to read/modify page DOMs — that’s the mechanism you need. For security and usability, prefer the browser’s built‑in password manager instead of rolling your own storage when possible (Chrome exposes Google Password Manager to users but there is no public extension API to read the browser’s saved passwords). (developer.chrome.com)

A safe implementation pattern (high level):

  • Inject a content script that detects the login form and asks the extension for credentials.
  • The extension service worker/background script calls your PHP API (HTTPS) to fetch an encrypted blob (never raw plaintext) or a per-user token, after authenticating the user.
  • The service worker sends the credentials to the content script via runtime messaging; the content script fills the inputs and dispatches input events so frameworks detect the change.

Example minimal pieces (Manifest V3):

{
  "manifest_version": 3,
  "name": "AutoFillExample",
  "permissions": ["scripting","storage"],
  "host_permissions": ["https://*.facebook.com/*"],
  "background": {"service_worker":"service-worker.js"},
  "content_scripts":[
    {"matches":["https://*.facebook.com/*"], "js":["content-script.js"], "run_at":"document_idle"}
  ]
}

Content script listens for messages and fills fields; the background/service worker uses fetch() to call your PHP endpoint and then sends the password to the content script. Use the content-script / messaging / MV3 docs while implementing. (developer.chrome.com)

Critical security rules and quick tips

  • Do not store plaintext passwords on the server or in chrome.storage (the extension storage area is not encrypted). If you must allow retrieval, store credentials encrypted with a user-controlled master secret and decrypt client-side. Follow OWASP guidance for password storage and key handling. Consider native messaging to a local, OS-protected vault instead of keeping secrets in the extension. Test for CORS, CSP and ensure you dispatch real DOM input events after setting values. (developer.mozilla.org)

If time is short: implement server-side encrypted vault + extension prompts user for a short master passphrase (never uploaded) to decrypt the returned credential client-side. This gives a workable PHP + JS solution while avoiding storing plaintext.

Recommended Answers

All 4 Replies

Member Avatar for Yasaswi_1

Thank you for your suggestion. But, tie information I've asked for is just for learning purpose and to update my knowledge. Please help me on that if it is possible. Thanks again :)

Member Avatar for Member #120589

Chrome extensions are written in Java AFAIK - so why are you using PHP? Is this going to be running as a service? So the minimal java code will contact your service to get info from the DB. This sounds ok in theory, but security-wise it would make me sweat as you're actually retrieving real passwords, not hashes or anything else.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.