# How to solve "We dont allow add-ons to use remote APIs"

**URL:** <https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809>\
**Category:** Development\
**Created:** [September 4, 2017, 9:58am UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809 "2017-09-04T09:58:04Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 4, 2017, 9:58am UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/1 "2017-09-04T09:58:04Z")

</div>

Hello 🙂

I got this Feedback from a reviewer:

1. We don’t allow add-ons to use remote APIs because they can create serious security vulnerabilities. Please insert those APIs locally from your add-on code.

I do not understand the last sentence…

How to solve it? How to get data from remote sites (like to insert in local plugin database)?

I am wondering about this, because other toolbar also fetch data via API and they are not declined.

If here is a reviewer in forum, I can give extension name.

Thank you.  
Best regards,  
Sven

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 4, 2017, 12:37pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/2 "2017-09-04T12:37:04Z")

</div>

Which addon is it?

Remote scripts are not allowed. Some scripts can be included in the addon.

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 5, 2017, 10:14am UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/3 "2017-09-05T10:14:42Z")

</div>

Yes, but the reviewer wrote remote API. I think its a write error. Its the addon with that UUID

{60361262-f72d-484e-b047-a231a277c1de}

You checked the addon before and we resolved all open issues. Then another reviewer denied it with that confusing message…

Thank you for checking 🙂

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 5, 2017, 11:50am UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/4 "2017-09-05T11:50:23Z")

</div>

> [@svenj](#):
>
> {60361262-f72d-484e-b047-a231a277c1de}

Only Admin can find addons by their ID. I need a normal URL or at least a name.

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 5, 2017, 2:16pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/5 "2017-09-05T14:16:14Z")

</div>

Name is: CASHCOW - Das CashBack-Tool  
Account Username: wonderunited

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 5, 2017, 3:43pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/6 "2017-09-05T15:43:35Z")

</div>

`store.min.js` is still minified and requires unminified source uploaded and then it goes into the admin queue.

There are 73 JS files. Do you need to use JQuery localisation with 58 minified JS files?

Where do you get a remote script?

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 6, 2017, 12:35pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/7 "2017-09-06T12:35:55Z")

</div>

I dont know where to upload unmified source. But here is the github project with full sources:

> **[marcuswestin/store.js](https://github.com/marcuswestin/store.js)**
>
> store.js - Cross-browser storage for all use cases, used across the web.

  
I removed unused localisation files … Uploaded that in new version 0.1.7  
What do you mean with last question? I dont use any remote script …

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 6, 2017, 12:42pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/8 "2017-09-06T12:42:14Z")

</div>

> [@svenj](#):
>
> What do you mean with last question? I dont use any remote script …

That was the reason for rejection… remote script/API

So where does it happen so I can check?

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 6, 2017, 12:49pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/9 "2017-09-06T12:49:56Z")

</div>

user.js Line 270 (Ajax Request)  
user.js Line 343 (XMLHttpRequest)

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 6, 2017, 2:42pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/10 "2017-09-06T14:42:39Z")

</div>

> [@svenj](#):
>
> user.js Line 270 (Ajax Request)  
> user.js Line 343 (XMLHttpRequest)

Depending on how the data is used, it can be OK.

- Addon needs a privacy policy.
- Data must be sent with user consent (opt-in or from user action e.g. login)
- The received data (JSON), if inserted in a document, must be inserted as text (not html./innerHTML etc)

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 6, 2017, 3:05pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/11 "2017-09-06T15:05:15Z")

</div>

Thank you for your reply.

(1) I can add privacy policy text under Login form?  
(2) I add sentence to login form, that data will sent to login remote  
(3) do you know a quote/secure function? I have to do something like this:  
element.html(’[p]’+securefunc(rawdatafromjson)+’[/p]’)  
Can I do that? Because I also must add static html + received raw data

I found that jQuery way:

‘[p]’+$(rawremotedata).text()+’[/p]’

---

<div class="post-metadata">

**Author:** ![erosman](https://sea1.discourse-cdn.com/flex001/user_avatar/discourse.mozilla.org/erosman/32/15447_2.png) [@erosman](https://discourse.mozilla.org/u/erosman)\
**Post date:** [September 6, 2017, 3:28pm UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/12 "2017-09-06T15:28:54Z")

</div>

> [@svenj](#):
>
> (1) I can add privacy policy text under Login form?

No… Privacy Policy for the addon.  
We require add-ons which send potentially private or personally identifiable information to provide a Privacy Policy detailing what information is sent, and how that information is used and protected.

Privacy Policy should be an actual text, not just a link to a website.

Please go to Edit your addon

> Manage Authors & License  
> Privacy Policy

> [@svenj](#):
>
> (2) I add sentence to login form, that data will sent to login remote

Also mention in Addon’s description

> [@svenj](#):
>
> (3) do you know a quote/secure function? I have to do something like this:
> 
> element.html(’[p]’+securefunc(rawdatafromjson)+’[/p]’)
> 
> Can I do that? Because I also must add static html + received raw data

No… that would get rejected

If you are using JQuery, something like this; (I dont use JQuery)

```
$('#box').append(
  $('<div/>')
    .attr("id", "newDiv1")
    .addClass("newDiv purple bloated")
    .append("<span/>")
      .text("hello world")
);

```

The important part is the remote data must be added as TEXT eg `.text(rawdatafromjson)`

---

<div class="post-metadata">

**Author:** ![svenj](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@svenj](https://discourse.mozilla.org/u/svenj)\
**Post date:** [September 7, 2017, 11:26am UTC](https://discourse.mozilla.org/t/how-to-solve-we-dont-allow-add-ons-to-use-remote-apis/18809/13 "2017-09-07T11:26:26Z")

</div>

Thank you for the feedback. I resolved all issues with new version 0.1.9. Please check …