1541050 - [Content Blocking] "Turn off blocking for this site" is not available for moz-extension pages

Status: NEW

(Firefox :: Protections UI, defect, P3)

Description

[Paul Heil]

Attachment: content_blocking.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

My extension uses Microsoft Graph for transferring files thus Microsoft as a third party tries to set/read a cookie.

Actual results:

Request to access cookie or storage on “https://login.live.com/Me.srf?wa=wsignin1.0&idpflag=direct&wreply=https%3a%2f%2flogin.microsoftonline.com” was blocked because it came from a tracker and content blocking is enabled.

When clicking the extension name to turn off blocking for the site (extension page) the button is not displayed so there is no way to whitelist it.

Expected results:

The button described here should show on extension pages.

https://www.mozilla.org/en-US/firefox/67.0/content-blocking/start/?step=3&newtab=true

Comment 1

[creesch.r]

While it would be nice to be able to disable content-blocking on the user level if you are the developer of the extension you can actually already get it to work. It is just that you need to set the proper permissions in your extension manifest.json

I struggled with this for a bit until I read the manifest.json section on MDN a bit closer: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#Host_permissions

Specifcially the line that says

bypass tracking protection if the host is a full domain without wildcards.

So in your extension manifest.json you should probably include

    "permissions": [
        "https://login.live.com/",
        "cookies",
    ]

Comment 2

[Paul Heil]

Attachment: Content_blocking2.png

Pop-up message with content blocking set as standard and domains white listed in manifest

Comment 3

[Paul Heil]

Attachment: Content_blocking_custom_disabled.png

Pop-up with blocking disabled.

Comment 4

[Paul Heil]

Thank you creesch.r that does seem to help getting the login to work.

I guess it depends on what the developers want, but there is still some odd behavior with content blocking even after adding those items.

Note this is what I have included in my manifest

"https://login.microsoftonline.com/*",
"https://login.live.com/*",
"cookies",

With standard content blocking enabled it still looks like 'content_blocking.png', but it shows that third-party cookies are blocked at first login. After reloading the page it still acts like it is blocking cookies, but doesn't list anything.

I see cookies listed in the site data so it seems like they are not really blocked.

Changing the level of blocking to custom and unchecking all of the options I get the message that cookies are detected, but again nothing listed.

Comment 5

[creesch.r]

(In reply to Paul Heil from comment #4)

"https://login.microsoftonline.com/*",
"https://login.live.com/*",
"cookies",

You are still including wildcards. Try this

"https://login.microsoftonline.com/",
"https://login.live.com/",
"cookies",

Or possibly if you need the wildcards

"https://login.microsoftonline.com/*",
"https://login.live.com/*",
"https://login.microsoftonline.com/",
"https://login.live.com/",
"cookies",

I do agree that firefox's behavior in all this is rather odd and probably too restrictive regarding webextensions. Specifically because most extensions do go through a validation process so it isn't as if they are going to be a big privacy risk.