Re: Solid Auth for web browser extensions (Former: Usability and scalability of Solid-OIDC in a decentralized ecosystem)

Hi Elf,

We made a browser extension to manage Solid identities: https://github.com/SolidLabResearch/solid-identity-manager
This Chrome extension acts as a remote control to manage your Solid identities and make it easy for users to switch between their WebIDs or IDPs. The way this works is by giving users the option to add profiles to the extension which it will store to persist over the course of its use.

Initially, we also worked on an extension that took care of the authentication itself, so users didn’t have to do that for every app. There were a couple of issues with that: authenticating in an extension was not trivial and the user gives all control to the extension because they authenticate with the extension and not the app itself.

--
Kind regards
Pieter Heyvaert
Development lead and developer advocate
Diversity, equity, and inclusion ambassador
Ghent University, IDLab – imec
He/Him


From: elf Pavlik <elf-pavlik@hackers4peace.net>
Date: Monday, 28 April 2025 at 16:17
To: public-solid@w3.org <public-solid@w3.org>
Subject: Solid Auth for web browser extensions (Former: Usability and scalability of Solid-OIDC in a decentralized ecosystem)
On 2025-04-28 06:19, Sarven Capadisli wrote:
> On 2025-04-28 14:02, elf Pavlik wrote:
>> Do you have this web browser extensions use case captured in LWS UCs
>> repo? To be honest I'm to familiar with how they work. For example
>> what is used as a `redirect_uri`?
>
> Contextual Interactions via Native User Agent or Add-on:
>
> https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fw3c%2Flws-ucs%2Fissues%2F55&data=05%7C02%7CPieter.Heyvaert%40ugent.be%7C5d7182019cdd48319fd608dd865f6e61%7Cd7811cdeecef496c8f91a1786241b99c%7C1%7C0%7C638814466632044774%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=FokzYAroh%2F8PiFUSKyZx1c5jjQY9oAyPVTsSXobj%2Fy0%3D&reserved=0<https://github.com/w3c/lws-ucs/issues/55>
>
> As I understand it, currently browser extensions can use dynamic client
> registration and use the location at the time of initiating the login
> process as the redirect URI. With static client registration, this URI
> will be validated against the redirect URIs specified in the Client ID
> Document, and here is where the flow breaks for the case of an
> extension.

Thanks Sarven, this is very helpful for me to start understanding your
use case!

I made a typo in my previous email, I'll blame it on writing it at 6AM,
I'm NOT familiar with nuances of browser extensions.

I started doing some searches and it may require some more research. For
example Chrome/Chromium extensions seem to use chromiumapp.org for
redirect urls.

https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fm2kdevelopments.medium.com%2F25-understanding-chrome-extensions-oauth-2bd175964384%23c7b4&data=05%7C02%7CPieter.Heyvaert%40ugent.be%7C5d7182019cdd48319fd608dd865f6e61%7Cd7811cdeecef496c8f91a1786241b99c%7C1%7C0%7C638814466632074862%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=t7fEChMtJoIfzkxrb5jXRESqqblFwkfo%2BS7hLAOEBCY%3D&reserved=0<https://m2kdevelopments.medium.com/25-understanding-chrome-extensions-oauth-2bd175964384#c7b4>

In Firefox I found this post with 0 replies

https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdiscourse.mozilla.org%2Ft%2Fhow-to-integrate-google-oauth-for-calendar-access-in-firefox-extension-previously-successful-in-chrome%2F134818&data=05%7C02%7CPieter.Heyvaert%40ugent.be%7C5d7182019cdd48319fd608dd865f6e61%7Cd7811cdeecef496c8f91a1786241b99c%7C1%7C0%7C638814466632096425%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=10Ub4UqW98iUCssSHAukS0fn6APGYm0G1puOnp%2BvaV8%3D&reserved=0<https://discourse.mozilla.org/t/how-to-integrate-google-oauth-for-calendar-access-in-firefox-extension-previously-successful-in-chrome/134818>

Do you know how many people in Solid community, besides you, have
experience with developing browser extensions?

Cheers!