4

Can a Manifest v3 Firefox extension request the "Access your data for all websites" permission from the user at runtime?

This option is usually managed in the firefox about:addons built-in page:

Firefox about:addons page

Some features of my extension require this permission to work, and I want to prompt the user to grant it if it hasn't been granted yet.

The desired workflow is as follows:

When the user clicks a button to trigger a feature that requires this permission, the extension checks if it has the permission to access data for all websites.

If the permission has not been granted yet, the extension should request it from the user. If the permission has already been granted, the feature should be triggered.

I have tried using the browser.permissions API, but I could not find a way to request this specific permission at runtime.

Is there any other way to request this permission from the user at runtime, or is it simply not possible?

Edit:

Not sure if this is the intended behavior, but sending a permission request with only "origins" and no "permission" key specified seems to work:

browser.permissions.request({origins: ['<all_urls>']})
Hal_9100
  • 773
  • 1
  • 7
  • 17
  • 1
    In Chrome you can use chrome.permissions + optional_host_permissions (not host_permissions). Apparently Firefox hasn't implemented it yet. – wOxxOm Apr 23 '23 at 05:57
  • Thank you. It appears that this permission is not present in the list of permissions supported by Firefox. However, I might have found a workaround. I tried sending a request for origins: "" with no "permission" key specified and it seems to work. I'll edit my question with the code. I am not sure if this is a bug or intended behavior though – Hal_9100 Apr 23 '23 at 06:18
  • Did you put this code in background file inside `chrome.action.onClicked.addListener(...` ? – Ahmad ElBullock May 17 '23 at 17:40
  • Never mind! I was able to fire it from content script and It MUST be triggered from a 'call to action' button. So onInstall I open my welcome page to the user and open a permission modal with an 'Accept' button – Ahmad ElBullock May 19 '23 at 19:03

2 Answers2

1

Solution

Sending a permission request with the "origins" parameter set to "<all_urls>" is equivalent to requesting the "Access your data for all websites" permission:

browser.permissions.request({origins: ['<all_urls>']})

Why does it work?

The MDN Permissions documentation states that both origins and permissions parameters are optional.

By setting origins: <all_urls>, the extension is effectively requesting permission to "Access your data for all websites".

The presence of this permission can be checked by invoking browser.permissions.getAll() and checking the presence of <all_urls> in permissions.origins.

Implementation example:

const hasAllUrlsPermission = () => {
    return browser.permissions.getAll()
        .then(permissions => permissions.origins.indexOf("<all_urls>") > - 1);
}

Compatibility

This solution was tested on Firefox v.112.

About <all_urls>

Granting the <all_urls> permission in a Firefox extension can pose a risk to security and privacy.

For this reason, Mozilla Extension Workshop recommends to

Avoid host permission <all_urls> if you can.

Where possible and applicable, their recommandation is to

Use activeTab rather than tabs and host permissions

Hal_9100
  • 773
  • 1
  • 7
  • 17
0

Use 'manifest_version' as 2 instead of 3 in your manifest.json file. Using V2 is still considered acceptable and now it should work.

When you download an add-on on Firefox, you will, now, encounter a prompt requesting permission to "Access all data for all websites."

Here is a screen capture of solving the problem:

Access your data for all websites, prompt.

Alex01
  • 330
  • 3
  • 14