crxviewer
crxviewer copied to clipboard
Skip CORS Anywhere for AMO-hosted add-ons in the web version
The web version of crxviewer uses CORS Anywhere to read the source code of extensions. In March, AMO already started to support CORS on publicly available XPI files: https://github.com/mozilla/addons/issues/5875 Soon, the AMO CDN will also include CORS headers on such XPI files: https://bugzilla.mozilla.org/show_bug.cgi?id=1620084#c5
Once the last change has landed, the web version of crxviewer doesn't require CORS Anywhere for XPI files from AMO any more. Skipping CORS Anywhere would result in a better user experience, since the CORS Anywhere proxy doesn't need to be used any more.
Related: The Firefox add-on version doesn't use CORS Anywhere, but domain fronting as a work-around for the inability to read data from AMO. With the CORS response headers, domain fronting is not required any more for publicly readable XPI files hosted on AMO and its CDN. The domain fronting work-around should still be kept however, to make sure that cookies are included in the request for XPI files behind authentication (an alternative is to use the cookies API to manually fetch and add relevant cookies, but that would require more work and another permission).