SESS-Shirazu-Autologin: Cryptographically Secured Portal Automator
A high-performance Chrome Manifest V3 browser extension built to streamline daily authentication on Shiraz University's educational system (SESS). Protects user credentials with client-side AES-GCM-256 Web Crypto API encryption while guaranteeing zero third-party telemetry.
1. The Challenge of Academic Portal Authentication
University academic portals frequently suffer from aggressive session timeouts (forcing re-login multiple times daily) alongside clunky legacy ASP.NET/PHP login forms that fail to cooperate cleanly with standard browser password managers. Students and faculty lose significant time repeatedly re-entering credentials and solving repetitive verification steps.
However, automated login extensions often represent massive security risks: bad implementations save usernames and passwords in plaintext inside chrome.storage.local, leaving them vulnerable to malware or malicious extensions. SESS-Shirazu-Autologin resolves this by wrapping credentials in military-grade AES-GCM-256 encryption using the browser's hardware-backed Web Crypto API.
2. Zero-Plaintext Cryptographic Architecture
Credentials are encrypted prior to persistence. Decryption keys are derived on-the-fly and never leave ephemeral memory:
// Client-Side Hardware Encryption via Web Crypto API
async function encryptCredentials(password, key) {
const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit AES-GCM IV
const encoded = new TextEncoder().encode(password);
const ciphertext = await crypto.subtle.encrypt(
{ name: "AES-GCM", iv: iv },
key,
encoded
);
return {
iv: Array.from(iv),
data: Array.from(new Uint8Array(ciphertext))
};
}3. Key Architectural Advantages
Instant `document_start` Execution
Injected into the DOM before external fonts, trackers, or heavy stylesheets execute, populating input fields in under 35 ms without visual jumping.
Strict Air-Gapped Operation
Manifest V3 CSP completely disables outbound remote network traffic. All cryptographic routines and DOM manipulation occur 100% locally on the client device.
Intelligent CAPTCHA Handling
Detects portal security challenge triggers and automatically focuses the cursor directly into the verification box, minimizing user friction.
Clean Manifest V3 Service Worker
Built strictly with modern non-persistent service workers, consuming zero background battery when the university portal tab is not active.