Host_permissions not allowing cors requests

[bridger.maxwell]

I am developing a Manifest V3 extension for our web app. I am running into a CORS issue trying to use host_permissions.

I have added our domain to host_permissions as "host_permissions": ["https://mozilla.com/*"], (except using our domain instead of mozilla.com). When I try to make a fetch request to our domain it is being blocked with the error Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at [...] (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 302. The request is being made from a background script.

In Chrome I am able to make this request without CORS issues. The only difference is in Chrome I’m using a background service_worker instead of a background script.

The docs for host_permissions say that host_permission privileges include “fetch access to those origins without cross-origin restrictions.” Is there something else I need to add?

Thanks for your help!

[juraj.masiar]

I think host permission are not granted without user approval or something in MV3.

[Blog post] Manifest v3 in Firefox: Recap & Next Steps

I think we chatted about this over matrix, but the issue is about host permissions, in MV3, they’re not granted automatically on install, but instead user needs to grant them at some point. Depending on what’s appropriate for your extension, you could ask the user using promise.request() , or they can grant it by going to about:addons, selecting your addon, and flipping the toggle in the permissions tab. We’re also working on an easier UI to do this, tied to your extension browser action, but…