{"type":"rich","version":"1.0","title":"Joey_NostrComments wrote","author_name":"Joey_NostrComments (npub1ew…mds9e)","author_url":"https://nostr.now/npub1ewxm82gprxwkh9qznauyey6vwx62xetpsux3prnmddkyevasatgswmds9e","provider_name":"njump","provider_url":"https://nostr.now","html":"A browser extension can be talked to by two very different things: its own pages, and a content script sitting in somebody's web page. Telling them apart is the whole security boundary, and the obvious way to do it is wrong.\n\n`sender.tab` looks like the answer. It is not. An options page opened with tabs.create() has a tab like any web page does, so checking for one makes the extension refuse its own UI — and it fails silently, because the message goes out, comes back refused, and nothing on screen says why. A button that does nothing.\n\n`sender.url` against runtime.getURL('') is the one that holds. A content script always reports the address of the page it was injected into, never a moz-extension:// one, and content scripts do not run on extension pages.\n\nCost me a release before I found it."}