1880600 - WebExtension MV3 manifest.json - host_permissions are not automatically enabled

Status: RESOLVED DUPLICATE of bug 1839129

(WebExtensions :: Untriaged, defect)

Description

[voltron]

Steps to reproduce:

Create a WebExtension using Manifest V3 with these permissions in the manifest.json:

"host_permissions": [
"https://api.openai.com/",
"https://chat.openai.com/"
]

These are needed - they are not optional for the functionality of the extension.

Actual results:

Now, when installing the extension from Mozilla Add-on Store, Firefox shows a popup "Add <extension name>?" with buttons "Add" and "Cancel". At this stage the user doesn't get any information about required permissions.

After installing the WebExtension the requested host_permissions are DISABLED BY DEFAULT. In practice that means that the WebExtension doesn't work at all.

What's worse is that the user has almost no way of understanding why it doesn't work.

The user has to:

1. Understand to click the cryptic "puzzle piece" icon
2. Click the "cog" icon next to the WebExtension name
3. Click "Manage Extension"
4. Click "Permissions" tab
5. Use slide widgets to enable both host permissions
6. Reload the page where the extension is supposed to work

There's also an additional bug. In the Firefox UI the permissions are listed as "Optional permissions" but they are not optional (optional permissions would be defined with manifest.json key "optional_host_permissions")

Now imagine someone who has never used extensions before. Will they know they need to do this (no-one seems to read the WebExtension description where these instructions are)? Even experienced people who have used WebExtensions don't know they need to do this.

We have already got several low ratings for our extension because of this.

Expected results:

Since these permissions are defined as "host_permissions", they are mandatory. They are listed on the WebExtension page on AMO and when the user installs the extension, the permissions should become automatically enabled without any manual configuration by the user.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.