What is the security profile of Mendeley Web Importer?
Last updated on June 18, 2020
Mendeley Web Importer is a browser extension which facilitates easy retrieval and import of reference metadata and associated full text articles. The following information is provided for institutional IT security teams who wish to have a technical insight into permissions that the extension uses.
- Cookies – Read users' cookies. This is required to enable maintenance of a signed in session with Mendeley.
- ActiveTab – Get URL of active tab. This is required to save web page metadata.
- WebRequest and WebRequestBlocking – Listen to and modify requests for pages and services. This is required to enable the extension to communicate with Mendeley back-end retrieve metadata and add reference services.
- <all_urls> – Interact with any page the user loads. This is required to locate document identifiers and make calls on behalf of the user to retrieve contents from full text links.
- Storage – Store and retrieve data stored in the browser. This is required to remember preferences, such as the last collection to which a reference was saved.
- Notifications – Pop-up messages in the browser. This is required to display error conditions. It is not used for advertising purposes.
- Downloads – Download content from browser to device. This is required to save PDF files to your computer. Currently, download functionality is only offered for resources discovered via scopus.com.
Category | Storage | Name | Hostname | Lifespan | Description |
|---|---|---|---|---|---|
Necessary | Cookie | __cfduid | .mendeley.com | 30 days | Cloudflare user id – used to detect malicious users |
Performance | Cookie | _dc_gtm_UA-3874710-1 | .mendeley.com | 0 | Google Tag Manager |
Performance | Cookie | _ga | .mendeley.com | 2 years | Google Universal Analytics |
Performance | Cookie | _gat | .mendeley.com | 1 minute | Google Universal Analytics |
Performance | Cookie | _gid | .mendeley.com | 1 day | Google Universal Analytics |
Performance | Cookie | aa_usr | .mendeley.com | Session | Identify the user to Adobe Analytics business analytics logging service |
Necessary | Cookie | csrf-token | .brxt.mendeley.com | 2 years | Validate requests to protect against cross-site request forgery |
Functional | Extension | hasConsent | N/A | Indefinite | User has consented to use of cookies, etc. |
Necessary | Cookie | mendeley-br-xt | .brxt.mendeley.com | 2 years | Token authenticating browser extension to the browser extension server |
Necessary | Cookie | msso | .mendeley.com | Session | Mendeley single sign-on authentication token |
Necessary | Cookie | node_session.sig | .mendeley.com | Session | Persist user data between requests |
Performance | Cookie | optimizelyBuckets | .mendeley.com | 6 months | Optimizely A/B testing variant |
Performance | Cookie | optimizelyEndUserId | .mendeley.com | 6 months | Optimizely A/B testing user id |
Performance | Cookie | optimizelyPendingLogEvents | .mendeley.com | 15 seconds | Optimizely A/B testing user activity |
Performance | Cookie | optimizelySegments | .mendeley.com | 0 | Optimizely A/B testing audience segmentation |
Functional | Extension | recentFolders | N/A | Indefinite | Recently selected library folders for quick access /td> |
Mendeley Web Importer does not directly communicate with Mendeley Desktop or Mendeley Reference Manager applications.
The extension communicates with the Mendeley browser extension service https://brxt.mendeley.com/build-info for authentication, document look-up and interaction with the user's Mendeley library on port: 443.
If you have any further technical questions relating to the adoption of Mendeley Web Importer at your institution, please contact the product team directly on [email protected]
Did we answer your question?
Related answers
Recently viewed answers
Functionality disabled due to your cookie preferences