Open Bug 1851083 Opened 8 months ago Updated 19 days ago

Manifest V3 extensions with activeTab/tabs permission require user interaction not previously required, showing blue dot on desktop and no indicator on Android

Categories

(WebExtensions :: General, defect, P3)

defect

Tracking

(firefox117 affected, firefox118 affected, firefox119 affected, firefox120 affected, firefox121 affected)

Tracking Status
firefox117 --- affected
firefox118 --- affected
firefox119 --- affected
firefox120 --- affected
firefox121 --- affected

People

(Reporter: robert, Unassigned, NeedInfo)

References

(Blocks 2 open bugs)

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0

Steps to reproduce:

  1. Develop an new Manifest V3 low privileges extension using only 'activeTab' permission as recommended on MDN:

"permissions": [
"activeTab",
"scripting"
]

  1. Loading the extension in Firefox.

Actual results:

For every website there is a blue dot asking for permissions on the extensions menu button and on the extension button. This is annoying, the idea of the "activeTab" permission is that an extension can do things on a website with running an extension action, without annoying the user with permissions prompts or like this, the blue dot.

Expected results:

An extension with simple permissions like this, should not be asking for permissions with the blue dot on every web page. These kind of dots are annoying because it notifies the user something is new or needs attention, and on this case it isn't true. The extension action will run only when the button is activated

Reverting to a Manifest V2 extension with the same permission doesn't show the blue dot.

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Product: Firefox → WebExtensions

Hello,

I reproduced the issue on the latest Nightly (119.0a1/20230903210251), Beta (118.0b4/20230903180219) and Release (117.0/20230824132758) under Windows 10 x64 and macOS 11.3.1.

I will set the issue to NEW, however, in my opinion the display of the attention dot on each page is useful and correctly implemented. The user should be notified that an extension needs explicit permission to run, then let the user decide if the user shall allow it or not and not grant the permission automatically. On the other hand, if the dot is not displayed and an extension needs permission to run, the user might think the extension does not work since the permission was not granted and the user was not notified that he should do so.

I will NeedInfo one of our developers to ask for a second opinion on this.

Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: needinfo?(lgreco)

I can't talk for every user but I find these dots annoying for things that don't requires my immediate attention. As an example, It is like the red dot on Edge to use a Microsoft account, the dot is placed there because a lot of people will get annoyed and just make an account to get rid of it.

As I explained on the original report, If I switch the manifest to version 2, there is no request for permissions at install time, no blue dot on every site and even I can access protected information like tab.url.

If the blue dot was important, it should have been important on V2 manifest too.

As a side note, a V3 extension with only optional permissions:

  "optional_permissions": [
    "*://*/*",
    "activeTab",
    "scripting"
  ]

In order to request permissions for each site if needed at runtime, shows the blue dot for every site. The idea of them being optional is that the extension can do some operation without these permissions and later ask for them if required.

Flags: needinfo?(lgreco) → needinfo?(tomica)

I think it's worth noting that this issue occurs if the extension only requests the "activeTab" permission. To reproduce it, add the following text to a file named "manifest.json" and load it as a temporary extension.

{
  "name": "Blue dot",
  "version": "0.1",
  "manifest_version": 3,
  "permissions": [ "activeTab" ],
  "action": {}
}

According to MDN:

If an extension has the activeTab permission, then when the user interacts with the extension, the extension is granted extra privileges for the active tab only.

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#activetab_permission

The MDN article doesn't indicate that the user must grant permission for every website in order for the extension to make use of tab-related functionality that the "activeTab" permission would allow.

This issue also affects our addon, which has the tabs permission, making it virtually useless.

Firefox for Android has the same issue, and the situation is worse: the addon’s script injection doesn’t work until you open the UI (popup on desktop) through the Add-ons menu, and there is no indication like a blue dot.

Blocks: manifest-v3
Component: Untriaged → General
Version: Firefox 116 → unspecified

It was also reported in the Firefox support as a very confusing behavior. The affected add-on was https://addons.mozilla.org/de/firefox/addon/duplicate_tab/ which uses the activeTab permission.

I agree that the blue dot is useful if there is something actionable for the user, for example if the user has to grant a permission. But that's not the case for the activeTab permission. It's confusing because the user can't do anything and the menu still shows the blue dot, without any chance to get rid of it. And so the menu draws attention to itself all the time, even though there is nothing for the user to do. The text in the add-ons menu that the add-on requires a permission does not help to reduce the confusion at all, as the user thinks they have to do something and that's not true.

@Alex Cornestean:

The user should be notified that an extension needs explicit permission to run, then let the user decide if the user shall allow it or not and not grant the permission automatically.

Agreed. But that's not the case for the activeTab permission. The activeTab permission just works, and there is nothing the user can grant or forbid.

I’ve quickly analyzed some extensions listed on the spreadsheet linked from this Add-ons Blog post and realized that most extensions still use MV2. We gotta back out our MV3 migration as it’s not a blocker for the Android support. 😔

Blocks: 1711787
Severity: -- → S3
Priority: -- → P3

The user should be notified that an extension needs explicit permission to run, then let the user decide if the user shall allow it or not and not grant the permission automatically. On the other hand, if the dot is not displayed and an extension needs permission to run, the user might think the extension does not work since the permission was not granted and the user was not notified that he should do so.

I wonder if there should be a way for an extension to indicate that it wants to work? In the case of my extension [1], it's not supposed to actually do something until the user clicks the icon. So the user is asked to pay attention to the icon for every page they visit, even though they'll usually don't actually want/need to pay attention to it. What makes it worse is that the only way to get rid of the notification icon, is to actually click the extension button, which activates it - which in most cases, they don't actually want to do! See [2] for a report logged by a user of my extension who was confused by this behaviour.

[1] https://addons.mozilla.org/addon/obfuscator/

[2] https://gitlab.com/vincenttunru/obfuscate/-/issues/14

My users of Trufflepiggy - Context Search are also super confused that a green circle appears below my extension icon (Firefox 121).

Trufflepiggy - Context Search also uses the activeTab permission. The only chance to get rid of it is to also request the <all_urls> permission which is truly unnecessary for a context menu extension. At least I never had issues since 2017 with the MV2 version of it.
Since the MV3 upgrade my user support inbox is so overfilled with questions about that behaviour that I might update host_permissions to <all_urls> just to get rid of these requests.

https://addons.mozilla.org/firefox/addon/trufflepiggy-context-search/

With a P3 priority I don't see this bug getting fixed any time soon (or ever :D), so it's best to switch back to MV2.
There really is no good reason to use MV3 in Firefox just yet, especially since MV2 supports many of the new MV3 introduced API so compatibility is great.
You can ask more questions here:

Perhaps we can implement optional_host_permissions (bug 1766026) and use that as a signal to opt out of the UI that notifies the user of the need to grant host permissions.

See Also: → 1766026

The dot can be hidden with this CSS:

#unified-extensions-button[attention] > .toolbarbutton-icon,
.unified-extensions-item[attention] > .unified-extensions-item-action-button.toolbarbutton-1 > .toolbarbutton-badge-stack {
  background-image: none !important;
}

The dot can be hidden with this CSS:

This is not a solution since it removes the dot in every case, and that's not what this ticket is about. If a permission actually has to be granted, the dot is a useful indicator and should be shown. But if the activeTab permission causes that the indicator is always there, it decreases the usefulness of the indicator.

I think the summary needs to be clarified.

Summary: Manifest V3 extensions with low privilege activeTab shows annoying blue dot for all websites → Manifest V3 extensions with activeTab/tabs permission require user interaction not previously required, showing blue dot on desktop and no indicator on Android

I forgot to say: We use Svelte + Vite to build our extension. I have created a Vite plugin that downgrades MV3 to MV2 for Firefox during packaging. If you’re interested, here’s the code:

https://github.com/videomark/videomark/blob/master/vite.config.js#L42
https://github.com/videomark/videomark/blob/master/vite-plugin-package-extension.js

You need to log in before you can comment on or make changes to this bug.