# Cross-platform JS addons for the reviewer

**URL:** <https://forums.ankiweb.net/t/cross-platform-js-addons-for-the-reviewer/46082>\
**Category:** Development\
**Created:** [June 16, 2024, 12:43am UTC](https://forums.ankiweb.net/t/cross-platform-js-addons-for-the-reviewer/46082 "2024-06-16T00:43:30Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![dae](https://sea2.discourse-cdn.com/flex002/user_avatar/forums.ankiweb.net/dae/32/65_2.png) [@dae](https://forums.ankiweb.net/u/dae)\
**Post date:** [June 29, 2024, 7:25am UTC](https://forums.ankiweb.net/t/cross-platform-js-addons-for-the-reviewer/46082/12 "2024-06-29T07:25:48Z")

</div>

> [@BrayanDSO](#):
>
> So, for now, just make the JS API an opt-in setting to make them a “known security risk”.

That is the approach I had to take with [LaTeX generation](https://forums.ankiweb.net/t/latex-latex-doesnt-work/46523/6), but it’s far from ideal. There will be users who toggle it accidentally, or toggle it and forget about it, and they’ll be at risk from that point onwards. And if any popular shared decks/templates/add-ons start depending on the API, that will encourage more users to put themselves at risk.

> [@BrayanDSO](#):
>
> Whenever the reviewer is in Svelte, the iframe solution can be done.

I’m sorry, I don’t think it would be responsible to introduce this new functionality without ensuring it’s secure from the start.

And there’s more than just an iframe to do - Anki and AnkiMobile currently have no way of distributing/installing JS outside of card templates and Python add-ons. AnkiDroid has an initial implementation based on npm, but that’s only a partial solution, which doesn’t cover things like a browsable list of available add-ons, reviews, etc.

> [@kioku](#):
>
> Anki could use a similar approach to [AnkiConnect](https://foosoft.net/projects/anki-connect/index.html#authentication) and require auth for any API requests,

That may be a good idea for other reasons. But the issue is that Anki’s internal code, and any add-ons, would need to hold the authentication key. If that code is running in the same context as shared deck JS, we risk the shared deck JS being able to extract the authentication key and make its own requests.

> [@kioku](#):
>
> Lest the idea of cards accessing this API get thrown out I’d just add that it would enable often-requested features such as the ability to edit notes from within the reviewer

I’d rather see card templates using less JS, not more. A lot of things being done in card templates currently isn’t necessarily specific to a particular card type (think answer timer, pretty tag formatting, etc). By moving these things out of the card templates and into separate add-ons that can be upgraded separately, it should make the shared decks more robust against upgrades, and hopefully make the templates less daunting to users as well.

---

_[View the full topic](https://forums.ankiweb.net/t/cross-platform-js-addons-for-the-reviewer/46082)._