Skip to main content

Expose Waylight /me Endpoint Chrome Extension

While building backend services and frontend interfaces for waylight.me applications, I frequently needed to inspect session identity data, extract auth headers, and retrieve userid and expertid attributes for backend testing. Repeatedly navigating to Chrome DevTools, searching through the Network tab for the /me API request, and manually copying cookie strings was an inefficient bottleneck.

To eliminate this friction, I built the Expose Waylight /me Endpoint Chrome Extension-a developer tool designed to extract session state directly from active tabs on *.waylight.me domains.

Expose Waylight /me Endpoint Chrome Extension​

Internal developer utility for rapid session context inspection and token extraction.

The Developer Bottleneck​

When engineering multi-tenant platforms or testing API endpoints locally (via Postman, curl, or automated integration tests), developers constantly need access to active session credentials:

  1. Session Context Verification: Ensuring the correct user or expert profile is active.
  2. Authentication Header Extraction: Extracting JWT bearer tokens or cookie values for backend test suites.
  3. Identity Field Mapping: Quickly referencing userid, expertid, or role-based flags.

Opening Chrome DevTools, navigating to Application > Cookies or Network > /me, and selecting individual values breaks context. The extension exposes these fields directly in a single popup window.

Core Capabilities​

  • Active Tab Inspection: Automatically detects active tabs matching *.waylight.me host patterns.
  • Instant Endpoint Extraction: Queries the /me user state to display structured key-value parameters (userid, expertid, organization IDs).
  • One-Click Clipboard Copying: Allows copying headers, authorization tokens, or individual identity fields instantly.
  • Minimal Permission Footprint: Operates only on designated host patterns (*.waylight.me) when the user opens the extension popup.

Architecture and Technical Implementation​

The extension is implemented using Chrome Extension Manifest V3, emphasizing tight permission scoping and minimal background runtime execution.

1. Manifest Configuration (Manifest V3)​

The extension scopes host permissions strictly to waylight.me subdomains to maintain safety and compliance with security standards:

{
  "manifest_version": 3,
  "name": "Expose Waylight /me Endpoint",
  "version": "1.0.0",
  "description": "Exposes open data from *.waylight.me active tabs for developer productivity.",
  "permissions": [
    "activeTab",
    "scripting",
    "cookies"
  ],
  "host_permissions": [
    "https://*.waylight.me/*"
  ],
  "action": {
    "default_popup": "popup.html",
    "default_icon": {
      "16": "icons/icon16.png",
      "48": "icons/icon48.png",
      "128": "icons/icon128.png"
    }
  }
}

2. Session Data Extraction Logic​

When launched, the extension popup injects a light script into the active tab context to read runtime storage or execute a lightweight fetch against the /me endpoint using the browser's active session credentials:

// popup.js - Injected active tab script execution
async function fetchMeEndpointContext() {
  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });

  if (!tab || !tab.url.includes("waylight.me")) {
    document.getElementById("status").textContent = "Not an active waylight.me tab.";
    return;
  }

  // Execute extraction in active tab context
  chrome.scripting.executeScript({
    target: { tabId: tab.id },
    func: extractSessionPayload
  }, (results) => {
    if (results && results[0] && results[0].result) {
      renderPayload(results[0].result);
    }
  });
}

function extractSessionPayload() {
  // Extract session fields from window state or local storage
  const userId = localStorage.getItem("user_id") || "N/A";
  const expertId = localStorage.getItem("expert_id") || "N/A";

  return {
    userId,
    expertId,
    timestamp: new Date().toISOString()
  };
}

Developer Workflow Impact​

By replacing manual DevTools inspection with a lightweight popup extension, my team achieved:

  • Faster Integration Testing: Instantly copying valid auth tokens directly into API client environments.
  • Reduced Friction: Switching contexts between frontend UI and backend API debugging takes milliseconds.
  • Zero Overhead: The extension remains idle until explicitly triggered by clicking the extension icon.