A proxy extension sits closer to a browser's traffic than almost any other add-on: it decides where every request goes, and it holds the credentials to do so. That makes it a common subject for an extension security review before a team rolls one out. This checklist sets out the questions worth asking of any proxy extension, how a reviewer can check each answer, and how the ProxyForge browser extension answers them, taken from its source code rather than from marketing copy.
Permissions: what it can do, and why
Start with the manifest, which every store package carries and which chrome://extensions summarises under Details. A proxy extension needs a few broad permissions by design, so the question is whether each one is explained and whether anything goes beyond the job.
The ProxyForge extension requires proxy, webRequest, webRequestAuthProvider, storage, alarms and scripting, plus access to all sites. In order: setting the browser's proxy, noticing a refused login or an unreachable proxy, answering the proxy's login challenge so no dialog appears, keeping proxies and settings, running the optional periodic refresh, and reading a signed-in dashboard session. Access to all sites is what lets the proxy apply everywhere and credentials be supplied for any proxy host.
The optional permissions are privacy, asked for when WebRTC leak protection is switched on; browsingData, to clear a proxy's stale login cookie after a refused login; identity, for one-click dashboard sign-in; and cookies. Firefox grants identity and contextualIdentities, used for per-container routing, at install.
What it stores, and in what form
Ask where credentials live, whether they are encrypted, and what survives a browser restart. On Chrome a reviewer can see everything the extension keeps by opening its service worker from chrome://extensions and running, in that console:
chrome.storage.local.get(null).then(console.log)
The ProxyForge extension keeps, in the browser's extension storage on the device:
- the proxies you add, with their usernames and passwords
- settings, the bypass and allow lists, per-site rules and PAC settings
- for a linked dashboard account, its access and refresh tokens, which have the same reach as the signed-in dashboard session
- for a linked provider, the API key you pasted or the session read from its dashboard tab
None of it is encrypted by the extension. Connection state, test results and the recent import log are held in session storage and are gone when the browser session ends. Settings also offers a Backup that writes imported proxies and settings to a file, with passwords in plain text; the extension warns about that, and a policy for where such files may live belongs in the review.
Where it connects, and when
This is where documentation and behaviour most often drift apart, so read it off the code or off the network, not off a policy page. In Chrome, the service worker's developer tools show each request the extension makes.
| Destination | When | What is sent |
|---|---|---|
| The proxy you connect | While connected | Browsing traffic and that proxy's credentials |
| The proxy's own address, plain HTTP | On connect, on Check again, after a failed tunnel | An empty request with no credentials and no cookies, to read why a login was refused |
api.proxyforge.io/tools/echo, or api.ipify.org when no dashboard is linked |
On connect and Check again | A request with no cookies, to learn the exit IP |
api.proxyforge.io |
On link, on sync, on the optional refresh, when a dashboard tab loads | A one-time sign-in token to exchange on one-click sign-in; after that the account's access token, and its refresh token when the access token expires. The reply is the proxy list |
| The dashboard's sign-in page | One-click sign-in only | The browser's sign-in redirect |
| Another provider's API | On sync, for a provider you linked | That provider's key or session |
www.google-analytics.com |
Only with usage statistics switched on | A random install id, the version, the action, and for a setting change which setting and its state |
| A PAC script address | While PAC routing is on | Fetched by the browser, as any PAC file |
The exit-IP check deserves a note: when no dashboard is linked, it goes to a third-party service, which sees the address you appear from.
Account tokens and what unlinking does
A linked dashboard account is the most valuable thing the extension holds, so check how it gets the session and how it lets go of it. The ProxyForge extension reads the signed-in session from the dashboard's tab: when you press Import from this tab, and also automatically when a dashboard tab loads. It refreshes the token pair against the dashboard's API when the access token expires.
Unlink removes the account's proxies and tokens from the browser. It makes no call to the dashboard, so the session there is not ended by unlinking. Offboarding therefore has two halves: unlink or remove the extension on the device, and end the session or rotate credentials centrally. Proxy credentials in general belong in a managed store with a rotation path; managing proxy credentials in a secrets manager covers that for servers.
Telemetry
Ask what is collected by default, where it goes and how to turn it off. In the ProxyForge extension anonymous usage statistics are off by default and sent only after a user switches them on in Settings. When on, events go to Google Analytics with a random install id generated on the device and the names of actions such as connect and disconnect. Proxies, logins, sites and browsing are not included. There are no ads and no separate extension account.
To verify, leave the setting off and watch the service worker's network panel through a connect and a disconnect: there should be no request to google-analytics.com.
Remote code and updates
An extension that fetches and runs code at runtime can change behaviour after review, so check the content security policy and look for dynamic code. The ProxyForge extension's pages allow scripts from the extension itself only (script-src 'self'), and its source has no eval or new Function. A PAC script you configure is run by the browser's own PAC engine. Updates arrive through the browser's extension store, which is the channel to watch for changes after the review.
A checklist to copy into the review
- List required and optional permissions; confirm each has a stated purpose.
- Confirm site access is needed for the job and nothing reads page content beyond it.
- Dump extension storage; list every credential and token it holds.
- Note whether stored credentials are encrypted; set device and profile controls accordingly.
- Decide where backup files may live, or ban them.
- Record every network destination from a network trace, with when and what.
- Confirm what the exit-IP check reveals and to whom.
- Confirm telemetry is off by default and absent from the trace when off.
- Check the content security policy and search for dynamic code.
- Document how a session is linked, refreshed and ended.
- Write the offboarding step for a lost device: which credentials to rotate centrally.
- Re-run the trace after each update the store delivers.
Questions for the provider behind the extension belong with the rest of vendor due diligence; a proxy vendor security questionnaire covers those. The browser extension page summarises the same data handling for people who need the short version, and the setup guide shows each screen involved.