CORS-problem with Chromium - events not getting sent from the browser

[tobixen]

Most likely due to a chromium upgrade (Chromium 141.0.7390.54), I get this error message:

Access to fetch at 'http://127.0.0.1:5600/api/0/buckets/aw-watcher-web-chrome_archlinux' from origin 'chrome-extension://nglaklhklhcoonedhgnpgddginnjdadi' has been blocked by CORS policy: Permission was denied for this request to access theunknownaddress space.

[RTnhN]

I had this problem too. When I went into the options for the extension and saved it (I did not need to change anything), that seemed to fix it. It seems that the extension maybe gets into a bad state and saving in the options resets it to a working state.

[tobixen]

I somehow managed to fix this, but I don't remember how. Possibly there was some local problems in my configuration. It seems like the server is supposed to deliver the right CORS headers.

[tobixen]

Ah, found my workaround ... in ~/.config/activitywatch/aw-server/aw-server.toml, this was "needed":

[server]
cors_origins = "*"

So the server has some default cors_origins setting, which was working earlier but stopped working for me. * may not be completely safe. I have problems understanding why * would involve any security risks in this case, but it may be due to my ignorance.

[ErikBjare]

@tobixen Setting it to * is indeed very unsafe and would give an attacker full access to your data ("Cross-Origin Resource Sharing") by getting you to visit any website (origin) they control and serve a malicious script from.

I suggest you set it to chrome-extension://nglaklhklhcoonedhgnpgddginnjdadi

The server is supposed to include this Chrome extension in the allowed origins by default, not sure why it isn't working.

[tobixen]

Gotcha. The security of ActivityWatch hinges on that only trusted clients have access to localhost:5600. Cross-origin browser scripts may act as a gateway, an attacker may be able to get out information about what URLs I'm browsing, what files I'm editing and the title of my windows (which may again be utilized for privilege escalation) and/or fill my timeline with junk (efficiently DoS'ing my computer). I deem the risk fairly low, but still I agree it shouldn't be like that.

The problem here is that the browser extention needs access to write to the database. I don't think it would be allowed if I add "localhost" as a trusted domain.