Can I stop JavaScript extensions from making API requests?

Not reliably if the extension runs in the same page as your app. Hiding fetch or wrapping XMLHttpRequest only covers some routes. Code with access to the page can also use elements such as images or forms to send data, and it may be able to reach your app's own functions and state.

For untrusted extensions, the boundary needs to be outside the JavaScript scope. Otherwise, installing an extension is effectively trusting it with whatever the page can access.

A sandboxed iframe is one browser option. Run the extension in its own context, preferably on a separate origin, and communicate through postMessage. Give it a small set of commands, like a request to update a specific editor value, rather than access to your app's API or DOM.

Validate each message and check its source and origin. A sandboxed iframe without allow-same-origin has an opaque origin, so origin checks alone aren't enough to identify it. Also check the sending window and design the channel for that case. Be careful which sandbox permissions you grant. A restrictive Content Security Policy for the extension can further limit network access, but the details matter and it shouldn't be treated as a magic switch.

Keep the server side in the picture too. If extensions get their own credentials, scoped tokens can restrict which API operations they can perform, with permission checks on every action. That doesn't stop an extension from sending note content elsewhere if you give it that content.

Also, an HttpOnly cookie isn't a network restriction. It prevents JavaScript from reading the cookie directly, but the browser may still attach it to eligible requests. Cookie settings and server-side authorization still matter.

If isolating editor extensions is too much work for the current design, make the trust model clear to users. Extensions running in the app can potentially access notes and act with the user's permissions, so installing one should not be presented as safe by default.