Firefox 64: The resource at XYZ was blocked because content blocking is enabled and the resource was classified as a slow tracking resource

Add-ons Development
#1

Hello,

I’m having a problem with new Firefox 64 - my favicon downloading seems to broken by new security restriction.

I’m using Google service for that, for example:
https://plus.google.com/_/favicon?domain_url=https://discourse.mozilla.org

Is there a way to fix this or my current approach is inherently wrong and I shouldn’t be using it in the first place?

#2

If you get the explicit host permission for https://plus.google.com/_/favicon tracking protection should not affect your requests to that resource. See also https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#Host_permissions

1 Like
#3

Nice, it works :slight_smile:.
However, this is this gonna trigger new Permission pop-up for all of my users, right?

#4

Yup, you can make it optional, if you want to…

#5

I tried, by it doesn’t work - probably because it’s called in the background script, not in the user-click event handler.
Also it’s used by all users, it’s not really optional :frowning:.

And if I change the URL to my server where I just return permanent redirect 301? Could that work?

#6

Pretty sure you’d have to fully proxy it, at which point you could just build your own service or build it client side…

#7

The proxy sounds good, but I would probably get banned by google after first 1000 requests :slight_smile:

Maybe Mozilla would like to build such service for all users - no tracking, open-source, fast… it would be a good marketing.

…at least I have full 12 weeks to find a solution (or maybe it’s time to finally request all those permissions I’ve been keeping back…).

#8

There’ll eventually probably be an API to get favicons, maybe. So there’s no reason for an external service for that. https://bugzilla.mozilla.org/show_bug.cgi?id=1315616

1 Like
#9

Is this an official service? I’m having trouble finding documentation. Also, it’s confusing that different URLs work. For example:

https://www.google.com/s2/favicons?domain=userchrome.org

I don’t know whether that would bypass the issue with the Google Plus or Googleusercontent domains.

1 Like
#10

Well… I found it two years ago “well documented” on StackOverflow :slight_smile: (and I still have on my Todo list written to find a better way to get favicons).

Anyway changing the URL works well! Thank you!
I hope the access to Firefox cached favicons will be done before this new URL get “classified as a slow tracking resource” as well.

#11

BTW generally it is bad idea to use that Google API (for privacy reasons), or well… at least you have to make your users aware of that.

Even currently, you already have a way to get the favicon for a site. If it is opened in a tab, you can just query the tab and get faviconUrl and include it.

And maybe we’ll get a better API anyway for getting the cached icon, as discussed before. :smile:

1 Like