Web eID
ID: ncibgoaomkmdpilpocfeponihegamlic
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- riaeeView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- EE
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- Pärnu mnt 139a Tallinn 11317 EE
- Website
- Visit
Use your electronic identification card for secure authentication and digital signing.
The Web eID extension enables the use of digital documents (ID-card, digital ID, e-Resident’s digital ID, residence permit card, etc.) for secure authentication and signing on the web. In addition to this extension, the Web eID native application must also be installed on the computer. Download the Web eID native application from here: https://www.id.ee/en/article/install-id-software/
The deprecated TokenSigning page script uses postMessage with wildcard '*' target origin, which means any window (including malicious iframes) could intercept these messages containing signing requests. However, this is a known pattern in the deprecated backwards-compatibility API, and the content script validates event.source === window before processing responses.
function messagePromise(msg) { if (!hasDeprecationWarningDisplayed) { console.warn("TokenSigning API is deprecated. Please consider switching to the new Web-eID library."); hasDeprecationWarningDisplayed = true; } return new Promise(function(resolve, reject) { window.postMessage(msg, "*"); eidPromises[msg.nonce] = { resolve, reject }; });}The content script injects a page-level script into every page (when TOKEN_SIGNING_BACKWARDS_COMPATIBILITY is enabled). This grants the injected script access to the page's JavaScript context, which is typical for eID extensions that need to expose a signing API to web pages. The script is loaded from the extension's own resources, not from an external URL.
function injectPageScript() { if (!document.querySelector("script[data-name='TokenSigning']")) { const s = document.createElement("script"); s.type = "text/javascript"; s.dataset.name = "TokenSigning"; s.dataset.by = "Web-eID extension"; if (browser.runtime.getManifest()["manifest_version"] >= 3) { s.src = browser.runtime.getURL("token-signing-page-script.js"); } else { s.innerHTML = "(" + pageScript + ")();"; } (document.head || document.documentElement).appendChild(s); }}The content script listens to all window messages and forwards qualifying messages (web-eid actions and TokenSigning events) to the background script, which then communicates with the native app. This is the standard architecture for eID extensions. The message validation checks event.source === window and validates action prefixes, limiting the attack surface.
window.addEventListener("message", async (event) => { var _a; if (isWebeidEvent(event)) { if (event.data.action === Action$1.WARNING) return; config.DEBUG && console.log("Web-eID event: ", JSON.stringify(event)); if (!window.isSecureContext) { const response = { action: event.data.action + "_FAILURE", error: new ContextInsecureError(), }; window.postMessage(response, event.origin); } else { let response; switch (event.data.action) { case Action$1.STATUS: { window.postMessage({ action: Action$1.STATUS_ACK }, event.origin); response = await send(event.data); break; }By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.3.0 | 3 |
| 2.2.2 | 4 |
Files with findings
3 distinct paths — top paths by unique finding count:
- content.js4
- token-signing-page-script.js2
- background.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.