The Power of Web Extensions and the Web as a Platform

The Power of Web Extensions

I'm really once again absolutely thrilled by the web as a platform. The browser has become the most important program runtime in recent years, and it's always amazing what is possible in modern browsers (but also modern JavaScript frameworks like React).

We Searched for a Long Time for a Solution to Import Images from WhatsApp

For about two years, I've been thinking repeatedly about how we can design the import (or export) of images or documents from WhatsApp to other programs in a secure and privacy-compliant way. WhatsApp belongs to Meta and is – whether you approve of it or not – simply the messenger with the widest reach.

What's cool: Message content in WhatsApp is end-to-end encrypted.

What's not cool: WhatsApp doesn't offer an API to programmatically receive WhatsApp messages. This is annoying in times of current automation tools (n8n, various LegalTech tools, MaraDocs…) because it means that manual steps remain necessary to get the documents.

What you can hardly believe: I just wrote that there was no API. That's not entirely correct. There is an API offered by Meta that allows you to receive and send messages. However, a WhatsApp Business account is required for this. And Meta grants itself comprehensive usage rights to the sent (and received) content:

The WhatsApp Business Terms Are Unacceptable from a Data Protection Perspective

Here is an excerpt from the current WhatsApp Business Terms:

I think it's obvious that importing confidential client communication via such a WhatsApp Business account is not feasible. So there is no usable API.

Meta thus grants itself comprehensive usage rights to the sent (and received) content. This means that no one who processes personal or other confidential data of their customers / clients can use a WhatsApp Business account. And with this, the possibility of programmatically (i.e., via API) accessing the messages or the sent images stands and falls.

How Do We Get Images from WhatsApp Exported Without a Data Protection Disaster?

This is where they get to shine: Web extensions, or browser extensions.

Browser extensions are programs that are loaded by the browser into certain websites after the fact and can interact with the content contained therein (in a very defined way).

And WhatsApp has opened a flank to its internals in its very closed and barricaded ecosystem by creating WhatsApp Web. You can log in to web.whatsapp.com via a QR code with your WhatsApp app on your phone and then receive all chats in a browser window for convenient use.

And we can intervene in this browser window with extensions.

The Architecture of a Browser Extension

The extension essentially provides three components:

• A background script, which runs independently of a current web page
• One content script each, which is "injected" into previously defined web pages and runs in their context

For security reasons, individual browser tabs are very strongly isolated from each other. This means direct communication between two web pages is not possible.

The background script of the extension takes on the function of a messaging hub. Both the content script in web.whatsapp.com and the content script on app.maradocs.io can each send messages to the background script and receive messages from there.

So if the WhatsApp content script wants to send an image to the MaraDocs content script, it packages the image in a text-encoded (Base64-encoded) message and sends it to the background script. Depending on the defined message type, it is then forwarded accordingly.

The MaraDocs content script in turn waits for such messages, validates them, and sends them (now via so-called CustomEvents) on to the original MaraDocs code.

Of course, the dog has a few more fleas here: In addition to general validation of the data (is everything correct in this message?), data from different messages must be assembled (CustomEvents have a size limit of one megabyte…). What about duplicate messages, what about missing messages… 100 more potential problems.

But when these individual steps are cleanly modeled and implemented, the magic trick is done and (multiple) image files have migrated from WhatsApp's normally closed ecosystem to MaraDocs with one click and can then be conveniently converted into proper PDF documents there.

This still fascinates me even after an intensive coding weekend.

This is MaraDocs: Optimize, Combine, Download

The workflow is consistently aligned with the needs of everyday law firm life: It must be fast and easy!

• Drag email with attachments or files via drag & drop or copy & paste into the app
• All attachments are automatically extracted and analyzed
• Documents are automatically recognized, cropped, and converted into searchable scans
• PDFs are compressed, text recognition is performed if necessary
• All pages are automatically aligned and rotated according to text direction
• Pages can be easily combined into new PDFs
• Renaming is just a single click
• Download. Done.