Building a Chrome Extension to Prevent Accidental Amazon SNS Unsubscription

I created a Chrome extension that adds a confirmation step to the Unsubscribe links found in emails from Amazon SNS.

https://chrome.google.com/webstore/detail/eehjapefklgpomfcpofoamigpcfgcjhh

Introduction

Notification emails from Amazon SNS automatically include a potentially dangerous unsubscription link at the end. Because of this, many people likely disable these unsubscription links.

https://repost.aws/ja/knowledge-center/prevent-unsubscribe-all-sns-topic

However, this method cannot be used for existing subscriptions, and if you are only in a position to receive emails, you may not have the authority to change these settings.

Therefore, instead of disabling the link, I created an extension that redirects access to the unsubscription link to a warning page on the client side to prevent accidental unsubscriptions.

Features and Usage

With the extension installed, clicking an Amazon SNS unsubscription link in an email or elsewhere will automatically redirect you to a warning screen.

At this point, you have not been unsubscribed yet.
If you clicked it by mistake, simply click the back button.

If you truly want to unsubscribe, click "Temporarily unblock and Unsubscribe".

Technical Mechanism

https://github.com/hato-se/Amazon-SNS-Unsubscribe-Safety

I am using the declarativeNetRequest API, which allows for blocking or redirecting requests.

For example, you can block Unsubscribe requests by writing a rule like the following:

[
    {
      "id": 1,
      "priority": 1,
      "action": { "type": "block" },
      "condition": {
        "urlFilter": "||sns.*.amazonaws.com/unsubscribe.html",
        "resourceTypes": ["main_frame"]
      }
    }
  ]

However, if you leave it like this, it will stay blocked forever, making it impossible to unsubscribe.

Therefore, I have implemented a mechanism that dynamically adds rules to handle redirection to a warning page and the intentional "unsubscription" action.

The logic works roughly like this:

1. Register a rule to redirect to the warning page when the extension is installed.
2. When the user clicks the button on the warning page, add an "allow" rule with a higher priority.
3. Delete the added "allow" rule once the page transition is complete.

Rules in the declarativeNetRequest API are applied based on priority (priority), so the higher the number, the higher the precedence.

Additionally, when redirecting, the original URL that was being accessed is passed to the warning page as a query parameter. This is done because the original URL would be lost if you redirected directly.

By the way, I check whether the page transition has finished using chrome.webNavigation.onCommitted.

Conclusion

If you also feel that "accidental clicks are scary!", please give it a try.
I hope this article is helpful to someone.