Firefox’s new WebExtensions permission system

Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.

Whenever you install an extension in Google Chrome, all of the extra permissions that the extension requests are listed in the installation prompt.

The idea is to provide users with information on these extra permissions, so that abusive extensions can be avoided.

The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.

Firefox's new WebExtensions permission system

firefox installation permissions

Mozilla plans to launch similar installation permissions in Firefox 54 at the earliest, but most likely in Firefox 55.

Firefox will display the extra permissions an extension requires during installation. The current iteration lists all permissions, but no additional information about them in the interface.

The permissions come from the manifest.json file of the extension. If you open it in a plain text editor, or a special json viewer (for instance the json viewer of Firefox), you find them listed under the permissions section. This is true for Chrome and Firefox WebExtensions. Please note that you need to extract the extensions file first to get a listing of files included.

firefox webextensions permissions

Google published a page that lists all optional Chrome permissions that extensions may declare, and Mozilla published one as well. The permissions are not identical at this point in time, and it seems unlikely that they will ever be identical. Mozilla plans to support more APIs, and with that may come extra permissions that only Firefox supports.

The installation prompt listing the permissions the extension requires is triggered whenever a WebExtension is installed in Firefox. This includes installations from Mozilla AMO and third-party websites, extensions that get side-loaded, and during upgrades.

Firefox users who are interested in the feature can enable it right now. Please note that this landed in Firefox 53 Nightly, and that the permission does not exist by default (yet).

If you run at least Firefox 53, you may do the following to enable the permission prompts when installing WebExtensions in the Firefox web browser:

  1. Load about:config in the Firefox address bar and hit the Enter-key.
  2. Confirm that you will be careful if the warning page opens.
  3. Right-click in the main area on about:config, and select New > Boolean.
  4. Name that Boolean extensions.webextPermissionPrompts.
  5. Set it to true.

Any WebExtension installation afterwards triggers the installation prompt that highlights the requested permissions.

The main tracking bug for the feature is 1308292. Additional information is provided on Mozilla's Wiki website.

While we are at it: check out Firefox's permissions manager, and the new permissions system that Mozilla plans to launch.

Now You: Do you find the installation prompts useful?

Summary
Article Name
Firefox's new WebExtensions permission system
Description
Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.
Author
Publisher
Ghacks Technology News
Logo
Please share this article

Facebooktwittergoogle_plusredditlinkedinmail



Responses to Firefox’s new WebExtensions permission system

  1. marcelo novi March 6, 2017 at 4:11 pm #

    you're stuck to firefox

    • ArpitNext March 6, 2017 at 6:10 pm #

      Yes, Martin is the only prominent blogger still blogging about Firefox :p

      • Martin Brinkmann March 6, 2017 at 6:20 pm #

        Probably because I'm the only one still using Firefox ;)

      • Andy March 6, 2017 at 6:25 pm #

        ...and some of us appreciate it!

      • ArpitNext March 6, 2017 at 6:30 pm #

        @Andy: Of Course! In fact, I've subscribed to Firefox Category RSS Feeds* of Ghacks. My only source of what's up with the Mozilla and its browser. 👍

        (*Link: https://www.ghacks.net/category/firefox/feed/)

  2. Kevin March 6, 2017 at 4:43 pm #

    Thanks Martin for the tip.
    And Firefox devs are trying to copy chome still (instead of adding apis to webext to bring functionality parity)
    But they choose to ignore major problems like these
    https://bugzilla.mozilla.org/show_bug.cgi?id=610357

    • OK March 7, 2017 at 4:45 am #

      So it's actually a bug? I thought it's the way firefox works. It's quite annoying to lost the url if the page fail to load

    • Caspy7 March 7, 2017 at 11:36 pm #

      > instead of adding apis to webext to bring functionality parity

      Just going to claim that without researching it, eh? Well, this is the internet I guess.
      And no, that's not at all true.

  3. trek100 March 6, 2017 at 5:52 pm #

    I have __lots__ of useful FF addons
    working great
    in FF (and in Pale Moon!).

    Will my current FF addons
    still work
    in the new FF 54?.

    Will there be FF "WebExtensions"
    equivalent in functionality to my addons?.

    Will the conversion from current addons
    be "automatic" or "manual" (one by one)?

    Not being able to use
    my current FF addons anymore,
    would mean my dropping FF forever,
    and migrating 100% to Pale Moon or Chrome or Vivaldi.

    using:
    - Ubuntu Linux 12.04, 32-bit
    - FF and Pale Moon browsers.

  4. insanelyapple March 6, 2017 at 7:50 pm #

    Can I actually add extension and following the example shown here, deny it accessing tabs? Or this works in fashion "agree or you won't use it"?

    If webextensions permissions works the other way, would be it possible then to create an extension that would take in charge permissions for other extensions?

    • Martin Brinkmann March 6, 2017 at 7:59 pm #

      It is allow permissions and use, or disallow any permission as you can't install it then. You could in theory try and edit the extension, and remove permissions.

    • Sören Hentzschel March 7, 2017 at 12:21 am #

      It's all or nothing at the moment. Optional permissions are another feature coming to Firefox. But if the developer of the add-on declares all permissions as mandatory, then all permission are mandatory and you have to allow all to use the extensions.

  5. Q March 7, 2017 at 6:20 pm #

    "The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes."

    This is also true for Android Apps. It would good if a way to to determine if an app or extension truly requires a permission for its core functionality can be determined without having to manually test and check the different permissions combinations. This would probably make a good article.

Leave a Reply