Grant host_permissions by default
Categories
(WebExtensions :: Untriaged, defect)
Tracking
(Not tracked)
People
(Reporter: hi, Unassigned)
Details
Attachments
(2 files)
2023-05-22_10h14_43.png
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/113.0
Steps to reproduce:
I am working on one feed reader extension WebFeed[1].
Every time the user open one tab, WebFeed will check whether there is any RSS auto-discovery[2] link by injecting script. If there is, WebFeed will show a page action icon to indicate user.
When user click the page action icon, WebFeed will fetch the RSS/Atom xml
file and show the latest items. If user subscribe this feed, WebFeed will store this link into the local indexeddb.
WebFeed will crawl all feed links periodically by the alarm event in background. So WebFeed may fetch xml from any host.
In the MV2, I only need add the "<all_urls>" into the "permissions" key.
But in the MV3, I have no choice by put "<all_urls>" in the "host_permissions" key. However, it does not works, because this permissions are not granted initially.
Every time user open one tab, WebFeed need to check if there is any RSS/Atom link. As it is not granted by the host_permission, so the Firefox only show a small dot under the browser icon. Only after the user click the browser action can WebFeed be able to check the link. Besides, without granting the "<all_urls>" permission, WebFeed can not to fetch feed links in background.
Actual results:
WebFeed cannot execute script when user open new page and WebFeed cannot fetch feed links in background.
Expected results:
I want to let firefox grant the <all_urls> after WebFeed installed, as the Chome browser do.
|
||
Comment 1•2 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•2 years ago
|
||
Hello,
The provided extension from https://github.com/taoso/webfeed appears to be MV2 and not MV3 according to the manifest.json file and it’s also missing the “host_permissions” key.
As such, I cannot verify the behavior you are describing, as loading the extension into Firefox does nothing when accessing websites with RSS feeds (no page action, no dot under extension icon).
Please provide an example extension matching the criteria you described, so I can test the behavior you are seeing.
As an alternative, I installed the extension that is publicly available on addons.mozilla.org (https://addons.mozilla.org/en-US/firefox/addon/webfeed/) and this one appears to work. The page action is displayed on websites with RSS feeds, though it does not ask for any user input in allowing permissions.
(In reply to Alex Cornestean from comment #2)
Hello,
The provided extension from https://github.com/taoso/webfeed appears to be MV2 and not MV3 according to the manifest.json file and it’s also missing the “host_permissions” key.
As such, I cannot verify the behavior you are describing, as loading the extension into Firefox does nothing when accessing websites with RSS feeds (no page action, no dot under extension icon).Please provide an example extension matching the criteria you described, so I can test the behavior you are seeing.
As an alternative, I installed the extension that is publicly available on addons.mozilla.org (https://addons.mozilla.org/en-US/firefox/addon/webfeed/) and this one appears to work. The page action is displayed on websites with RSS feeds, though it does not ask for any user input in allowing permissions.
Sorry for inconvenience. I have forgotten to push my local code. Please see the mv3 branch.
Thanks.
|
|
||
Comment 4•2 years ago
|
||
Hello,
Thank you for providing the MV3 extension !
Indeed host controls have become optional and the user must grant them via what you described in Comment 0. These permisions will be granted once though per website visit i.e. once the website is reloaded the permission is taken away and must be granted again. However, there is a way to grant permissions permanently to either <all_urls> or for a specific host.
To grant permanent permissions for a particular host, once on the desired website and the dot appears under the extensions puzzle button, click the button to open the panel. There, right click on the extension icon and select “Always Allow on [website]”. This will grant the permission to the extension permanently for that specific domain.
Moreover, you can grant access to <all_urls> from the “Permissions” panel of the extension in Addons Manager (about:addons). Simply go to about:addons, click on the extension to access the detailed view and then click on “Permissions”. Under “Optional permissions for added functionality” you can enable “Access your data for all websites” and so the extension will have <all_urls> permission.
|
|
||
Comment 5•2 years ago
|
||
|
|
||
Comment 6•2 years ago
|
||
Hi, Alex,
Tanks you for detailed reply :)
If grant <all_urls> default is not an option, can Firefox add an item of "Always Allow on All Websites" in the extension right click menu?
There is only "Only When Clicked", "Always Allow on [websize]" two item. And all Access your data for all websites in the Permissions page is far too deep for normal use.
|
||
Comment 8•2 years ago
|
||
We're planning to improve the host permission granting flow of new installs. Meanwhile, you'd need to add UI to your extension itself to make the user aware of the need to grant permissions, using the permissions API. Note that this logic is also needed in Chrome; while Chrome extensions are currently granted access by default, the extension cannot assume the permissions to always have been granted. When the user revokes the permission manually, the extension has to call permissions.request() again.
Here are two examples to demonstrate how host permissions can be requested:
- Example with
options_ui: https://github.com/mdn/webextensions-examples/tree/main/dnr-dynamic-with-options - Example with
actionpopup panel: https://github.com/mdn/webextensions-examples/tree/main/dnr-redirect-url
Description
•