1957822 - Extensions cannot request permissions from a popup window

Status: UNCONFIRMED

(WebExtensions :: Untriaged, defect)

Description

[the10thwiz]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0

Steps to reproduce:

This bug was found in the Reddit Enhancement Suite browser extension:
https://github.com/honestbleeps/Reddit-Enhancement-Suite

1. Open a popup window using chrome.windows.create({ url: 'prompt.html', type: 'popup' })
2. Call chrome.permissions.request({ permissions, origin }) from inside a button's click event listener.

If the type is 'normal', this works as expected. Additionally, opening the same page in a normal tab, or even in a popup window opened via window.open, workes as expected.

Actual results:

Nothing.

Expected results:

A popup should have opened, asking the user to allow the extension to add additional permissions.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'WebExtensions::Untriaged' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Alex Cornestean]

Hello,

I tried reproducing the issue but got stuck at Step 2. Would you be so kind and provide some more detailed steps as to how to call chrome.permissions.request({ permissions, origin }) from inside a button's click event listener ?

Calling chrome.windows.create({ url: 'prompt.html', type: 'popup' }) from the extension console (about:debugging -> Inspect) will create a popup window where the user is requested to click the “Request permission” button to grant the required permission. However, clicking it throws 4 errors in the web console (F12) as shown in https://github.com/honestbleeps/Reddit-Enhancement-Suite/issues/5530#issuecomment-2707004567. The optional permission request dialog is not triggered this way.

I also tried calling chrome.permissions.request({ permissions, origin }) from the same web console of the popup window but I got another error – “Uncaught ReferenceError: permissions is not defined`, most likely because I’m not calling in the correct area.

Tested on the latest Nightly (139.0a1/20250402162225) and Release (137.0/20250327043313) under Windows 11.

Comment 3

[the10thwiz]

Sorry, forgot to add - permissions and origin are local variables setup by RES. Their values should be [] and ["https://*.redd.it/*"] respectively.

The permission request can be simplified to chrome.permissions.request({ permissions: [], origin: ["https://*.redd.it/*"]] }) to avoid setting up local variables.

Comment 4

[Alex Cornestean]

Hello,

I tried reproducing he issue once more with the new information you provided.

Calling chrome.windows.create({ url: 'prompt.html', type: 'popup' }) from the extension console opens the popup window as expected, but then calling chrome.permissions.request({ permissions: [], origins: ["https://*.redd.it/*"] }) from the web console (F12) of the popup window throws an undefined.

Calling chrome.windows.create({ url: 'prompt.html', type: normal }) form the extension console opens a new window with a moz-extension://…/prompt.html URL but then calling chrome.permissions.request({ permissions: [], origins: ["https://*.redd.it/*"] }) from the web console (F12) of the new window also throws an undefined. As per Comment 0, the optional permissions request dialog should have opened, but it doesn’t.

From the popup window console, I get the page URL via window.location and then paste the URL in a new tab and call chrome.permissions.request({ permissions: [], origins: ["https://*.redd.it/*"] }) in the web console (F12) of the tab. Same results as above, the call throws an undefined.

For all the calls to request the permission, the browser console (Ctrl+Shift+J) logs a Unchecked lastError value: Error: permissions.request may only be called from a user input handler error.

Am I doing something wrong?

Tested on the latest Nightly (139.0a1/20250406090220) and Release (137.0/20250327043313) under Windows 11.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:willdurand, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Rob Wu [:robwu]]

Me to take a look at what's going on.

Comment 7

[the10thwiz]

For all the calls to request the permission, the browser console (Ctrl+Shift+J) logs a Unchecked lastError value: Error: permissions.request may only be called from a user input handler error.

Yes - this is an intentional part of Firefox's design. As noted here (https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/permissions/request), this API is only allowed to be called from an event handler, in response to a user action (developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/User_actions).

Setting up the page to make this happen is a bit more complex. Basically, you need to add a button, and bind the relevant API call as an event listener. The aforementioned extension (Reddit Enhancement Suite) sets this up - it opens a popup, with a button to (attempt to) trigger the permission popup.

The following adds a button, and configures the click callback to call the permissions API.

button = document.createElement('button');
button.innerText = 'Click to request permissions';
button.addEventListener('click', () => {
    console.log("Button clicked");
    chrome.permissions.request({ permissions: [], origins: ["https://*.redd.it/*"] });
});
document.body.append(button);