Chrome Extension (MV3) – Fix 403 API Issue (Headers/Cookies/Session)

I have a Manifest V3 Chrome extension that automates visa-appointment scheduling by extracting session tokens, fetching open slots, and submitting the final form. The logic works locally when I replay calls, yet every live request fired from the service-worker is met with a 403 Forbidden.

Here is what I already know and have tried:
• All calls reproduce perfectly in the Network tab of DevTools, so I can share HAR files and screenshots.
• Manual header tweaks and dedicated Puppeteer scripts confirm the endpoints themselves are stable.
• My hunch is that something in the session handling chain is being dropped or regenerated between the content script and background worker, because the same headers and cookies succeed when fired outside the extension.

You will receive the full codebase, build scripts, logs, and the failing request payloads. With DevTools, Postman, and Puppeteer at your disposal, I’d like you to pinpoint where the session context is lost, patch the extension, and document the fix.

Deliverables
1. Updated source files (service-worker, content script, helper modules) that perform all three steps—token extraction, slot retrieval, and form submission—without 403 responses.
2. A concise change log explaining what was wrong, how you traced it, and how it was resolved so I can replicate the approach on future endpoints.
3. A short verification video or step-by-step notes proving the working flow in Chrome Stable.

Acceptance criteria
• No 403s when booking flow is run end-to-end in an incognito profile.
• Session remains valid for at least one full booking cycle without manual cookie injection.
• Extension passes Manifest V3 compliance checks and builds cleanly with Node.js.

If you have untangled similar header, cookie, or session problems inside Chrome extensions before, I look forward to your insight. Remember to begin your proposal with “EXT-403”.