How to reset a website media permissions from a chrome extension

Question

I'm working on developing a chrome extension that adds the ability to users to stream videos from any website they want by using Agora SKD. What the extension supposed to do is showing the streaming video screen inside the opened tab. I'm using Agora library to stream the videos.

Agora library requests media permissions(camera and microphone) for the opened website; If the user was on w3schools.com website, then media permissions will be granted to w3schools.com website.

Granting media permission to every website I need to inject my javascript code in and start video streaming on is not something very wise, because those websites can run scripts in the future that will access user's camera and microphone. That's why I'm looking for a way to limit websites access to those permissions.

The first way I thought in to show the video stream inside the tab without granting w3schools website media permission is embedding the video stream code in another website owned by my chrome extension mywebsite.com, grant my website the media permission and display my website within w3schools.com. I tried to put my website mywebsite.com inside a frame within w3schools.com website and ask for permission from my website. This doesn't work cause Chrome grants the permission to w3schools.com website and passed the permission to the frame that running my website.

<!--Allow camera and microphone access within the context of this iframe-->
<iframe src="https://mywebsite.com" allow="camera;microphone"></iframe>
<!--Other content of w3schools.com goes here-->

I tried to also look for a way to grant w3schools.com website media permissions temporarily and revoke the permissions after the video streaming is over but I couldn't find any way to do that.

I didn't find any way to revoke/reset the permissions using JS.
I didn't find any way to revoke/reset the permissions using chrome extension api interface. I didn't find anyway to temporarily grant the media permission to a tab(until it's closed or for a certain time). I didn't find anyway to access chrome://settings/content/siteDetails?site=https%3A%2F%2Fwww.w3schools.com and change the website permission from there.

So my questions are:

• How can I revoke the media permissions access for a website using chrome extensions?
• Is there a way where I can load my website https://mywebsite.com within w3schools.com and request the media permissions to https://mywebsite.com instead of w3schools.com?

Answer 1

This is by no means a complete answer, but I did some research to help you out.

Permissions.revoke() is deprecated

Seems like there used to be Permissions.revoke() functionality, but it has been deprecated for some reason: https://developer.mozilla.org/en-US/docs/Web/API/Permissions/revoke

There is a community draft for relinquishing permissions

I bumped into this W3C Community Draft about Revoke API: https://wicg.github.io/permissions-revoke/

Extensions have permission pages

Seems like extensions have permission pages. For example, I went to my Chrome's extensions page a chose Google Keep Chrome Extension for this:

I copied the id extension ID lpcaedmchfhocbbapmcbpinfpgnhiddi and made the following URL out of it:

chrome://settings/content/siteDetails?site=chrome-extension://lpcaedmchfhocbbapmcbpinfpgnhiddi

And this brought me to the following page:

I don't know if there is any use for this, but I thought it was interesting.

Exploiting chrome://settings/content/siteDetails reset-button functionality

I (also) tried to figure out what does Chrome's website permissions page do in order to revoke the permissions, but couldn't find an answer. I've actually tried to do something similar before and speaking from experience, something like this will most likely not work, e.g. Chrome has this stuff figured out and does not allow calling certain "system functions" from any page - that would make no sense.

The iframe idea won't work

Iframe's allow-attribute only delegates permissions from the parent page.

Your options

As far as I can tell right now, I believe your options are to either ignore the issue, find a way to disable Agora needing those permissions (if you only need to stream videos from websites, where do you need microphone or webcam anyway?), or replace Agora with something else - by utilizing the Media Streams API, this should be relatively simple.