title: Secure AJAX calls for a browser plugin
body: <p>In my browser extension I'm doing an Ajax request like this</p>
  
  <pre><code>$.ajax({
      type: 'POST',
      url: 'https://example.com/queryDatabase.php',
      data: {id: someID, data: "some data"}
  }).done(function (resp) {
      console.log(resp);
  });
  </code></pre>
  
  <p>Now everyone could inspect the source code and make a request with their own data.</p>
  
  <p>How do I authorize only requests coming from my extension and reject all others?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I'm posting the solution I came up with in an edit because someone closed the question although there wasn't an exact answer in the other post.</p>
  
  <p>So what I did was moving the ajax request to a php file on my server and then programmatically inject it with an <code>&lt;iframe&gt;</code> when needed. 
  This way you can indeed use the CSRF token method to secure the call like shown in <a href="https://stackoverflow.com/a/21885910/9525450">this</a> answer for example.</p>
  
  <p>Be aware that you can't use the extension API from the php file so you'll need to inject a content script in it to be able to exchange messages with the iframe, so you can get data from the API in the content script and pass them with a message (you can even do the request at your will by listening for a message and executing the call only when the message arrives).</p>