Is Howdou for Google Classroom safe?
Howdou for Google Classroom sends the signed-in teacher's email address and assignment IDs to embed.howdou.net on every interaction.
The extension scrapes the user's Google Classroom email from the page DOM and appends it as a plaintext URL parameter to multiple requests sent to embed.howdou.net. It also collects assignment stream item IDs from the page and POSTs them to embed.howdou.net whenever the user navigates or scrolls. All requests are made with credentials included.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Google Classroom Email Sent to Howdou
In Google Classroom, Howdou's content script reads your signed-in Google email from Classroom page links, then sends it as the `e` parameter to embed.howdou.net/gcapi/auth/statuscheck2.php, with credentials included.
You interact with Howdou while signed in to Google Classroom.
The content script only runs on Classroom pages, then reacts to Howdou controls and session checks.
The extension reads your Classroom account email from the page and adds it to a Howdou request.
The confirmed session-check request includes the email as the `e` query parameter.
| Field | Value | Why it matters | |
|---|---|---|---|
Google Classroom account email | alex.teacher@lincoln.k12.us (illustrative) | This identifies the signed-in Google Classroom account associated with the request. | |
Howdou session ID | 9f0a8c6d2b1e4f30 (illustrative) | This links the request to the active Howdou browser session. |
| Content-Type | application/json |
The shipped content script reads the email and sends it to the session endpoint
function getUserEmailAddress() {
var links = document.querySelectorAll(
"a[href^='https://accounts.google.com']"
);
for (var i = 0; i < links.length; ++i) {
if ( links[i].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/) ){
return links[0].getAttribute("aria-label").match(/([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)/)[0];
}
}
return '';
}function checkValidSession(){
var email = getUserEmailAddress();
//var ssoWin;
var xmlhttp = new XMLHttpRequest();
xmlhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
var response = JSON.parse(this.responseText);
if( response && response.valid_session != true ){
// Require login window
howdouSsoWin = window.open("https://embed.howdou.net/gcapi/auth/oauth.php?e="+email,"classroom_howdou_auth","width=600,height=600");
}else{
// Valid session active, load data
addImportFrame();
}
}
};
xmlhttp.open("GET", "https://embed.howdou.net/gcapi/auth/statuscheck2.php?e="+email+'&sid='+window.sessionStorage.getItem("howdousid"), true);
xmlhttp.withCredentials = true;
xmlhttp.setRequestHeader("Content-Type", "application/json");
xmlhttp.send();
}- embed.howdou.net
Receives the Classroom account email in the `e` URL parameter for session checks, OAuth launch URLs, assignment import frames, student-data frames, and schedule authorization URLs.