Firefox MV3 extension `host_permissions` are considered as optional permissions and are not automatically requested for approval on installation

[lnoss]

Context

I migrated as soon as possible the Firefox extension to MV3 for long-term purpose. But it seems that there is a non-standard behavior: Firefox uses host_permissions from package.json as optional. This is not the case with the Chromium world: optional permissions are optional. Chromium will automatically ask to approve or deny host_permissions on installation.

Also, you can't request a permission as you want:

To follow the principle of "no surprises", [some] APIs like this can only be called from inside the handler for a user action. User actions include the following:

• Clicking the extension's browser action or page action.
• Selecting a context menu item defined by the extension.
• Activating a keyboard shortcut defined by the extension (this only treated as a user action from Firefox 63 onwards).
• Clicking a button in a page bundled with the extension
  https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/User_actions

This behavior is clearly annoying because I already pushed 0.0.3 to Mozilla Addons store. I deactivated the release even if it was working if approving manually the permissions ; the store only gives the possibility to install 0.0.1 (firefox-mv2).

Solution

I am thinking about just asking to press a button to approve everything... But this is not optimal and I have no idea about how handle the removal of permissions at any time, I might need to monitor permissions change. Or just let the techy-users use the browser interface. Otherwise, it means implementing an options page with check-boxes because no one is going to open the settings and approve it manually. The actual green icon requesting for approval is not even visible/understandable.

User solution

Go in your extensions menu and right-click on the extension (or the gear) when using currently using Google Search/Google Translate proxy. Approve the right permission auto requested. You can approve more directly by managing the extension settings. Check official illustrations below.

Official illustrations

Documentation

• https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/permissions

Error: permissions.request may only be called from a user input handler.

[lnoss]

Also, runtime.onInstalled. Extension could open a tab with a grant permissions button with a callback to permissions.request(). No wonder people are tearing themselves apart between the two Manifest versions.

[lnoss]

Also, see Bugzilla 1839129.

Starting with Firefox 109 all host_permissions are considered optional so it appears what you are considering is an enhancement more than a bug.

🤐

[lnoss]

Should be able to remigrate now to MV3, per 1889402:

Grant origin permissions during install for mv3

[lnoss]

Or not:

Until Firefox 126, a Manifest V3 extension's requested host permissions weren't displayed in the install prompt. From Firefox 127, host permissions listed in host_permissions and content_scripts are displayed in the install prompt. However, if an extension update requests new host permissions, these are not shown to the user. See (Firefox bug 1893232).

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions

[lnoss]

If there is a way to resolve #34, then this one should be resolved too.