Skip to content

Clarification of difference between additional privileges granted in MV2 and MV3 host permissions #39260

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+1 −1
Open

Clarification of difference between additional privileges granted in MV2 and MV3 host permissions #39260

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion files/en-us/mozilla/add-ons/webextensions/manifest.json/host_permissions/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ Host permissions are specified as [match patterns](/en-US/docs/Mozilla/Add-ons/W

The extra privileges include:

- [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) access to those origins without cross-origin restrictions (though not for requests from content scripts, as was the case in Manifest V2).
- [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) access to those origins without cross-origin restrictions, but not for requests from content scripts. (This differs from the behavior of [host permissions in Manifest V2](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) that provided this privilege for requests from content scripts.)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a reader, I still find this wording a bit confusing.

The parenthetical sentence contrasts the described behavior with Manifest V2, but it wasn't clear that the first sentence was referring to Manifest V3 in the first place. This is further complicated by the fact that content script behaviors differ across browsers –  but lets table this concern for the moment.

I've taken a shot at rewriting this line to be more easily understandable on first read.

Suggested change
- [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) access to those origins without cross-origin restrictions, but not for requests from content scripts. (This differs from the behavior of [host permissions in Manifest V2](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#host_permissions) that provided this privilege for requests from content scripts.)
- the ability to use [XMLHttpRequest](/en-US/docs/Web/API/XMLHttpRequest) and [fetch](/en-US/docs/Web/API/Fetch_API) to perform HTTP requests on matching origins without encountering cross-origin restrictions. (In Manifest V3 extensions this only applies to requests issued from extension contexts. In Manifest V2 it also applies to requests made by content scripts.)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dotproto the manifest version is stated at the top of the page and clearly identifies that this feature is supported in 3 or above. So I don't believe there was a need to reword. The rewording adds ambiguity as it suggests this feature can be used in 2 and 3 but has different behavior in each.

- the ability to read tab-specific metadata without the "tabs" permission, such as the `url`, `title`, and `favIconUrl` properties of {{WebExtAPIRef("tabs.Tab")}} objects.
- the ability to inject scripts programmatically (using {{webextAPIref("tabs/executeScript", "tabs.executeScript()")}}) into pages served from those origins.
- the ability to receive events from the {{webextAPIref("webRequest")}} API for these hosts.
Expand Down