host_permissions manifest key documentation #15183

rebloor · 2022-04-21T02:58:21Z

Summary

Add documentation for the host_permissions manifest key becomes available with manifest V3. Also include updates to the permissions and optional_permissions manifest keys indicate that they no longer support the definition of host permissions in manifest V3.

Corresponding browser compatibility data provided in mdn/browser-compat-data#15933.

Related issues

TBC

Metadata

This PR…

Adds a new document
Rewrites (or significantly expands) a document
Fixes a typo, bug, or other error

github-actions · 2022-04-21T03:00:42Z

Preview URLs

Flaws

Note! 2 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions
Title: host_permissions
on GitHub
Flaw count: 1

bad_bcd_queries:
- No BCD data for query: webextensions.manifest.host_permissions

External URLs

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions
Title: host_permissions
on GitHub

https://extensionworkshop.com/documentation/develop/request-the-right-permissions/ (1 time) (Note! This may be a new URL 👀)
https://extensionworkshop.com/documentation/develop/test-permission-requests/ (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/optional_permissions
Title: optional_permissions
on GitHub

https://bugzilla.mozilla.org/show_bug.cgi?id=1766026 (1 time) (Note! This may be a new URL 👀)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions
Title: permissions
on GitHub

No new external URLs

(this comment was updated 2022-05-12 22:19:41.097894)

rebloor · 2022-05-09T04:30:12Z

@zombie a reminder this is awaiting your review

teoli2003 · 2022-05-09T04:52:02Z

Hi, @rebloor. A small tip: to prevent accidental merge, you can mark the PR as draft PR (even after its initial creation) which invalids the merge button.

zombie

Looks mostly good, with a one or two important changes.

Don't really love that host_permisions page mostly duplicates info from the permissions page, might be better if we could find a way to reference one from the other (and only list differences), but I don't have a good idea how best to do that. It's probably fine like this for the initial push, we can refine later.

zombie · 2022-05-11T23:14:19Z

files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md

@@ -48,6 +51,8 @@ The key can contain two kinds of permissions: host permissions and API permissio

 These are the same as the host permissions you can specify in the [`permissions`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) key.


maybe replace with, or add "(or host_permissions(link) when using Manifest V3 or higher)"?

I think the note on the next line covers this

zombie · 2022-05-11T23:20:43Z

files/en-us/mozilla/add-ons/webextensions/manifest.json/optional_permissions/index.md

@@ -48,6 +51,8 @@ The key can contain two kinds of permissions: host permissions and API permissio

 These are the same as the host permissions you can specify in the [`permissions`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) key.

+> **Note:** When using Manifest V3 or higher, host permissions must be specified in the [`host_permission`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions) manifest key.


This is true in Chrome, but not yet in Firefox (until bug 1766026, which is not currently a priority).

But maybe we're ok to document it like that, since that's where we want to end up eventually? I'm not sure which is better, so whatever think is more appropriate.

@mixedpuppy we're only including these changes now because they were supposed to be part of the development preview, if this isn't the case should we hold them for the next release? (Also remove reference from the extension workshop migration guide?)

@rebloor this (host_permissions) is part of dev preview. What isn't is the restriction noted. During dev preview, hosts can be in either host_permissions or optional_permissions. At some point, bug 1766026 will be fixed, and then hosts can be in either host_permissions or optional_host_permissions.

I think the comment can be made specific to chrome. We can then clarify the comment when that bug is done.

Yep, sorry for not being clear enough. I like what Shane proposed, just mention that this is currently only restricted in Chrome's MV3.

Thanks for the clarification, updated

zombie · 2022-05-11T23:24:57Z

files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md

@@ -0,0 +1,84 @@
+---
+title: host_permissions


The preview page has a visible underlined space in the H1 title, I'm not sure if that's an artifact of the preview generation or something else.

Unfortunately I don't get a proper preview, so couldn't comment but this line looks OK

I was just looking at the previews created by the bot #15183 (comment)

See what you mean, checked and there's no hidden characters there.

zombie · 2022-05-11T23:38:05Z

files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md

+
+The extra privileges include:
+
+- [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) access to those origins without cross-origin restrictions (even for requests made from content scripts)


(even for requests made from content scripts)
This is not true anymore in mv3, but instead of dropping it, we should probably call it out, since it's a change. Maybe something like "Though not for requests from content scripts, as was the case in MV2"?

zombie · 2022-05-12T00:35:11Z

files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md

+- the ability to inject scripts programmatically (using {{webextAPIref("tabs/executeScript", "tabs.executeScript()")}}) into pages served from those origins
+- the ability to receive events from the {{webextAPIref("webrequest")}} API for these hosts
+- the ability to access cookies for that host using the {{webextAPIref("cookies")}} API, as long as the `"cookies"` API permission is also included.
+- bypassing tracking protection for extension pages where a host is specified as a full domain or with wildcards. Content scripts, however, can only bypass tracking protection for hosts specified with a full domain.


I think the content scripts part here might be also incorrect for mv3, but I'll need to check.

Yep confirmed, this bit about content scripts can be removed as well.

Thanks, removed

files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md

…ermissions/index.md Co-authored-by: Tomislav Jovanovic <zombie@users.noreply.github.com>

zombie

lgtm, thanks!

* host_permissions manifest key documentation * Update files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md Co-authored-by: Tomislav Jovanovic <zombie@users.noreply.github.com> * Feedback updates Co-authored-by: Tomislav Jovanovic <zombie@users.noreply.github.com>

host_permissions manifest key documentation

569a36a

rebloor added the Content:WebExt WebExtensions docs label Apr 21, 2022

rebloor requested a review from zombie April 21, 2022 02:58

rebloor requested a review from a team as a code owner April 21, 2022 02:58

rebloor self-assigned this Apr 21, 2022

github-actions bot added the Content:Other Any docs not covered by another "Content:" label label Apr 21, 2022

rebloor mentioned this pull request Apr 21, 2022

Compatibility data for host_permissions mdn/browser-compat-data#15933

Merged

zombie requested changes May 12, 2022

View reviewed changes

rebloor and others added 2 commits May 13, 2022 09:45

Update files/en-us/mozilla/add-ons/webextensions/manifest.json/host_p…

3d2c4ba

…ermissions/index.md Co-authored-by: Tomislav Jovanovic <zombie@users.noreply.github.com>

Feedback updates

f51f85e

rebloor requested a review from zombie May 12, 2022 22:20

zombie approved these changes May 13, 2022

View reviewed changes

rebloor merged commit 5b49049 into mdn:main May 13, 2022

rebloor deleted the mv3-host-permissions branch May 13, 2022 16:07

rebloor mentioned this pull request Apr 24, 2025

Clarification of difference between additional privileges granted in MV2 and MV3 host permissions #39260

Open

		@@ -48,6 +51,8 @@ The key can contain two kinds of permissions: host permissions and API permissio

		These are the same as the host permissions you can specify in the [`permissions`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) key.

		@@ -48,6 +51,8 @@ The key can contain two kinds of permissions: host permissions and API permissio

		These are the same as the host permissions you can specify in the [`permissions`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) key.

		> Note: When using Manifest V3 or higher, host permissions must be specified in the [`host_permission`](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions) manifest key.


		The extra privileges include:

		- [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) access to those origins without cross-origin restrictions (even for requests made from content scripts)

host_permissions manifest key documentation #15183

host_permissions manifest key documentation #15183

Uh oh!

Conversation

rebloor commented Apr 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related issues

Metadata

Uh oh!

github-actions bot commented Apr 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview URLs

Flaws

External URLs

Uh oh!

rebloor commented May 9, 2022

Uh oh!

teoli2003 commented May 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zombie left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rebloor May 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zombie left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rebloor commented Apr 21, 2022 •

edited

Loading

github-actions bot commented Apr 21, 2022 •

edited

Loading

teoli2003 commented May 9, 2022 •

edited

Loading

rebloor May 12, 2022 •

edited

Loading