Is Video Downloader for U safe?
Video Downloader for U is medium risk. On Twitter/X while logged in, the extension reads your ct0 CSRF cookie and sends it to its worker, which combines it with a hardcoded Bearer token for Twitter API calls. This runs on every video lookup; ct0 goes out to api.twitter.com.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Twitter/X session token forwarded to authenticated API requests
On Twitter/X while logged in, the extension reads your ct0 CSRF cookie and sends it to its worker, which combines it with a hardcoded Bearer token for Twitter API calls.
This runs on every video lookup; ct0 goes out to api.twitter.com.
You browse a Twitter/X page that contains a video while logged into your Twitter account.
The extension reads your ct0 CSRF session cookie and passes it to the background service worker, which sends it as a request header in an authenticated call to api.twitter.com.
The ct0 cookie is a CSRF token Twitter uses to authenticate in-session API requests. The extension uses it as if it were operating on your behalf.
Cookie extraction and relay to background (content.js)
// content.js:3878
this.isCookiesSent || (r.x_csrf_token = this.getCookie('ct0'));
chrome.runtime.sendMessage({
message: 'get-twitter-link',
requestData: r // r = { tweetId, x_csrf_token: <ct0 value> }
}, function(e) { ... });| x-csrf-token | <user's ct0 session token> |
| Authorization | Bearer AAAAAAAAAAAAAAAAAAAAAPYXBAAAAAAACLXUNDekMxqa8h%2F40K4moUkGsoc%3DTYfbDKbT3jJPCEVnMYqilB28NHfOPqkca3qaAxGfsyKCs0wRbw |
The extension ships a Base64-encoded string in content.js that is the developer's Twitter OAuth2 app client_id:client_secret pair, used to obtain app-level Bearer tokens via the client_credentials flow.
PKKiu9IjEESHTRUsrjnHuc0Cl:soYL1fNkpCNlKp5MGH5BJFwOJ840zIbXeV0w8zqaQpQLN2E2YH
| Field | Value | Why it matters | |
|---|---|---|---|
Twitter/X session CSRF token | a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 | This cookie authenticates API requests as your account. Any service receiving it can make Twitter API calls on your behalf for your session. |
Decodes the hardcoded Base64 OAuth2 app credential from the extension source to confirm the client_id:client_secret pair, and illustrates the request shape the background worker sends.
// Reproducer: verify the hardcoded Twitter OAuth2 credential and the API call shape
// Run in Node.js — no network calls made.
const ENCODED = 'UEtLaXU5SWpFRVNIVFJVc3Jqbkh1YzBDbDpzb1lMMWZOa3BDTmxLcDVNR0g1QkpGd09KODQwekliWGVWMHc4enFhUXBRTE4yRTJZSA==';
const BEARER = 'AAAAAAAAAAAAAAAAAAAAAPYXBAAAAAAACLXUNDekMxqa8h%2F40K4moUkGsoc%3DTYfbDKbT3jJPCEVnMYqilB28NHfOPqkca3qaAxGfsyKCs0wRbw';
const decoded = Buffer.from(ENCODED, 'base64').toString('utf8');
console.log('Decoded app credential:', decoded);
const [clientId, clientSecret] = decoded.split(':');
console.log('client_id :', clientId);
console.log('client_secret:', clientSecret);
const exampleTweetId = '1234567890123456789';
const exampleCt0 = 'YOUR_CT0_COOKIE_VALUE_HERE';
console.log('\nSimulated API request shape:');
console.log('GET', `https://api.twitter.com/2/timeline/conversation/${exampleTweetId}.json?tweet_mode=extended&count=20`);
console.log('Headers:');
console.log(' Authorization:', `Bearer ${BEARER}`);
console.log(' x-csrf-token:', exampleCt0);
console.log('\n(x-csrf-token is read from the visiting user\'s ct0 browser cookie)');
- 1Save the file as check-twitter-cookie-relay.js.
- 2Run: node check-twitter-cookie-relay.js.
- 3Confirm the decoded client_id and client_secret match values above.