Content Script Isolation and Page Security
Understand isolated-world JavaScript, shared DOM, page-main-world bridges, untrusted page data, and lifecycle cleanup for Chrome content-script interfaces.
// Technical guide archive
More practical engineering notes, ordered by publication date.
Understand isolated-world JavaScript, shared DOM, page-main-world bridges, untrusted page data, and lifecycle cleanup for Chrome content-script interfaces.
Create stable Chrome context-menu items on installation, handle clicks in a worker, validate selection data, and avoid assuming the menu grants every capability.
Design PostgreSQL ownership, constraints, timestamps, relationships, and query-driven indexes, then plan migrations that preserve existing application behavior.
Trace route-level client imports, remove unnecessary browser dependencies, defer optional tools, and verify initial and interaction costs after bundle changes.
Place Next.js authentication, session verification, record authorization, and public projections in a server data layer while keeping proxy redirects as navigation aids.
Separate catalogue browsing from authoritative pricing, inventory, payment confirmation, and fulfillment so cached pages and repeated events cannot create bad orders.
Diagnose Manifest V3 worker failures by separating registration, event delivery, storage state, and idle termination; verify the cold path without open DevTools.
Find Manifest V3 remote executable code in packaged files and dependencies, separate data from logic, and remove CDN imports or downloaded code before submission.
Declare Chrome extension commands, distinguish _execute_action from custom handlers, diagnose unassigned shortcuts, and keep a clickable fallback.
Compare GraphQL and REST using real client data shapes, backend cost, authorization, caching, pagination, and the team's ability to operate each contract.
Choose responsive image sizes, reserve layout geometry, prioritize the actual hero, and verify Next.js image requests without damaging screenshots or accessibility.
Build Next.js forms with validated Server Actions, server-side authorization, structured field errors, pending UI, and an explicit policy for duplicate submissions.