Abstract: Some embodiments of the present disclosure provide a system for providing access control. The system may include an extension module for extending a host website; and a marketplace server that is configured to: receive a request to access the extension module from a browsing device, the browsing device is for maintaining a browsing session with the host website, and the extension module is for exchanging data with the host website; generate a first authorization token that is associated with the browsing session; and send, to the browsing device, the first authorization token. The extension module may be configured to receive a second authorization token from the browsing device. One of the extension module or the marketplace server may then be further configured to: verify that the second authorization token matches the first authorization token; and if verification is successful, the extension module can be allowed to exchange data with the host website and communicate with the browsing device.