Request permissions at install time manifest v3

Add-ons Add-on Support
#1

I’m testing an extension that needs access to read data on all sites. My understanding is that this is accomplished with "host_permissions" : ["<all_urls>"] in manifest v3. My expectation is that firefox requests this permission explicitly from the user, on the extension’s behalf, upon installation.

I can’t get this to work in firefox. (Chrome presents no problems.) By default, the extension does not have access to read data on all sites, and the user is not prompted to grant the permission. I should mention that I’m testing this as a temporary extension.

Using manifest v2, on the other hand, the following content script permission appear to be sufficient:

    "content_scripts": [
        {
          "matches":["<all_urls>"],
          "js":["js/content.js"]
        }
    ]

Although I am not prompted to grant these permissions when loading the extension as a temporary extension, the extension has the necessary permission on all sites by default.

How do I get this to work with manifest v3? This feels like a trivial question, but unfortunately I’ve come up short after lots of searching.

1 Like
Need help on how to ask permission to the user to have access to a website data (Manifest V3)
#2

In Chrome and Firefox MV2, the excerpt from your manifest.json automatically grants the host permission “<all_urls>”.
Firefox MV3 treats it as an optional permission instead, and the extension needs to explicitly ask the user to grant it:

“MV3 treats host permissions (listed in the extension manifest) as opt-in.”
Extensions button and how to handle permissions in Manifest V3

1 Like
#3

Thanks, but I don’t think this addresses how to request permission at install time.
permissions.request may only be called from a user input handler
My objective is for the user to be prompted to grant the necessary permissions without the user taking any action, so the restricted availability of the permissions API is a problem. Is it even possible to replicate the MV2 behavior in MV3?

Moreover – and perhaps this is because I’m doing something else wrong – my content script is not run at all until I manually run it from the extension toolbar, so nothing I do to programmatically will work until the user clicks the extension icon anyway.

#4

When you click the toolbar icon, your addon gets host permission for the current page through the “activeTab” permission. So that will allow your content script to be executed.
(that’s just an explanation of how it’s even possible :slight_smile: )

If don’t want any trouble, simply use MV2. It’s already compatible with MV3 so the changes are minimal and it solves these permission issues. I’m author of 10+ extensions and they are all MV3 in Chrome and MV2 in Firefox and it works great.

If you want to use MV3, and you want “install time permission”, the best you can do is create runtime.onInstalled handler and open new tab (as part of the onboarding) where you will tell user that you need some permissions and a huge button below that saying “Grant permissions”. And the callback you call the permissions.request().
But since user will be able to remove the permissions any time, you may need to monitor permissions change.

Note that Chrome is preparing some new UI for the extensions that will allow users more easily remove permissions from extensions:
https://bugs.chromium.org/p/chromium/issues/detail?id=1463363
(so you may need some permissions check in the Chrome too, especially since extensions with all_urls permission will be shown as “running” on every page, and many people won’t like it for sure)

3 Likes
#5

There’s a bug report about the current state of host permissions in MV3, and planned changes:
Offer optional host permissions for MV3 during install flow

2 Likes
#6

Requesting permission at install time via runtime.onInstalled() cannot be the only solution.

If, for some reason, the permission is later revoked, the extension may become useless, leaving the user unaware of what happened and how to fix it.

I think that at any location in the extension where the permission is required, you will need to check if its allowed using permissions.contains(). If it’s not, display some clarification message and ask the user to grant the permission with a button that will initiate permissions.request()

2 Likes
#7

Actually, you are correct :smiley:, more than I though!
Officially it’s recommended to use:

However, what to do in the callback? Open new tab saying to user that you really need that permission? But if user ignores it? Next time he will try to use the addon, things won’t work and he may not remember why :slight_smile:.

So yeah, you better re-check for permissions whenever they are needed.

Now that I think about it, this is how Android apps works these days - their permissions are even removed automatically if you don’t use the app often and next time you start it, it will ask you for permissions again.

2 Likes
#8

Thanks all for your help, I really appreciate it! I think the best solution for me (for now) is to stick with MV2 in firefox, MV3 in chrome. Keep things simple :sunglasses: I will certainly revisit these other options when it becomes necessary!

1 Like