Firefox's new WebExtensions permission system - gHacks Tech News

Firefox's new WebExtensions permission system

Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.

Whenever you install an extension in Google Chrome, all of the extra permissions that the extension requests are listed in the installation prompt.

The idea is to provide users with information on these extra permissions, so that abusive extensions can be avoided.

The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.

Firefox's new WebExtensions permission system

firefox installation permissions

Mozilla plans to launch similar installation permissions in Firefox 54 at the earliest, but most likely in Firefox 55.

Firefox will display the extra permissions an extension requires during installation. The current iteration lists all permissions, but no additional information about them in the interface.

The permissions come from the manifest.json file of the extension. If you open it in a plain text editor, or a special json viewer (for instance the json viewer of Firefox), you find them listed under the permissions section. This is true for Chrome and Firefox WebExtensions. Please note that you need to extract the extensions file first to get a listing of files included.

firefox webextensions permissions

Google published a page that lists all optional Chrome permissions that extensions may declare, and Mozilla published one as well. The permissions are not identical at this point in time, and it seems unlikely that they will ever be identical. Mozilla plans to support more APIs, and with that may come extra permissions that only Firefox supports.

The installation prompt listing the permissions the extension requires is triggered whenever a WebExtension is installed in Firefox. This includes installations from Mozilla AMO and third-party websites, extensions that get side-loaded, and during upgrades.

Firefox users who are interested in the feature can enable it right now. Please note that this landed in Firefox 53 Nightly, and that the permission does not exist by default (yet).

If you run at least Firefox 53, you may do the following to enable the permission prompts when installing WebExtensions in the Firefox web browser:

  1. Load about:config in the Firefox address bar and hit the Enter-key.
  2. Confirm that you will be careful if the warning page opens.
  3. Right-click in the main area on about:config, and select New > Boolean.
  4. Name that Boolean extensions.webextPermissionPrompts.
  5. Set it to true.

Any WebExtension installation afterwards triggers the installation prompt that highlights the requested permissions.

The main tracking bug for the feature is 1308292. Additional information is provided on Mozilla's Wiki website.

While we are at it: check out Firefox's permissions manager, and the new permissions system that Mozilla plans to launch.

Now You: Do you find the installation prompts useful?

Summary
Firefox's new WebExtensions permission system
Article Name
Firefox's new WebExtensions permission system
Description
Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.
Author
Publisher
Ghacks Technology News
Logo
Advertisement

We need your help

Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats or subscription fees.

If you like our content, and would like to help, please consider making a contribution:


Previous Post: «
Next Post: »

Comments

  1. marcelo novi said on March 6, 2017 at 4:11 pm
    Reply

    you’re stuck to firefox

    1. ArpitNext said on March 6, 2017 at 6:10 pm
      Reply

      Yes, Martin is the only prominent blogger still blogging about Firefox :p

      1. Martin Brinkmann said on March 6, 2017 at 6:20 pm
        Reply

        Probably because I’m the only one still using Firefox ;)

      2. Andy said on March 6, 2017 at 6:25 pm
        Reply

        …and some of us appreciate it!

      3. ArpitNext said on March 6, 2017 at 6:30 pm
        Reply

        @Andy: Of Course! In fact, I’ve subscribed to Firefox Category RSS Feeds* of Ghacks. My only source of what’s up with the Mozilla and its browser. 👍

        (*Link: https://www.ghacks.net/category/firefox/feed/)

  2. Kevin said on March 6, 2017 at 4:43 pm
    Reply

    Thanks Martin for the tip.
    And Firefox devs are trying to copy chome still (instead of adding apis to webext to bring functionality parity)
    But they choose to ignore major problems like these
    https://bugzilla.mozilla.org/show_bug.cgi?id=610357

    1. OK said on March 7, 2017 at 4:45 am
      Reply

      So it’s actually a bug? I thought it’s the way firefox works. It’s quite annoying to lost the url if the page fail to load

    2. Caspy7 said on March 7, 2017 at 11:36 pm
      Reply

      > instead of adding apis to webext to bring functionality parity

      Just going to claim that without researching it, eh? Well, this is the internet I guess.
      And no, that’s not at all true.

  3. trek100 said on March 6, 2017 at 5:52 pm
    Reply

    I have __lots__ of useful FF addons
    working great
    in FF (and in Pale Moon!).

    Will my current FF addons
    still work
    in the new FF 54?.

    Will there be FF “WebExtensions”
    equivalent in functionality to my addons?.

    Will the conversion from current addons
    be “automatic” or “manual” (one by one)?

    Not being able to use
    my current FF addons anymore,
    would mean my dropping FF forever,
    and migrating 100% to Pale Moon or Chrome or Vivaldi.

    using:
    – Ubuntu Linux 12.04, 32-bit
    – FF and Pale Moon browsers.

  4. insanelyapple said on March 6, 2017 at 7:50 pm
    Reply

    Can I actually add extension and following the example shown here, deny it accessing tabs? Or this works in fashion “agree or you won’t use it”?

    If webextensions permissions works the other way, would be it possible then to create an extension that would take in charge permissions for other extensions?

    1. Martin Brinkmann said on March 6, 2017 at 7:59 pm
      Reply

      It is allow permissions and use, or disallow any permission as you can’t install it then. You could in theory try and edit the extension, and remove permissions.

    2. Sören Hentzschel said on March 7, 2017 at 12:21 am
      Reply

      It’s all or nothing at the moment. Optional permissions are another feature coming to Firefox. But if the developer of the add-on declares all permissions as mandatory, then all permission are mandatory and you have to allow all to use the extensions.

  5. Q said on March 7, 2017 at 6:20 pm
    Reply

    “The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.”

    This is also true for Android Apps. It would good if a way to to determine if an app or extension truly requires a permission for its core functionality can be determined without having to manually test and check the different permissions combinations. This would probably make a good article.

  6. Random-Host said on November 22, 2017 at 11:14 am
    Reply

    These prompts are useless since they provide no information what those permissions actually do.

    What does “access” mean?

    Read access?
    Write access?
    Can that extension read my bank details when I do online banking?
    Can that extension tamper with the data I exchange with websites?
    Does that extension compromise my privacy?

    Right now, those prompts are nothing but confusing and I won’t install any of the extensions which require “extra permissions” since Mozilla failed to provide ANY information what those permissions actually mean, neither in Firefox itself nor anywhere on the web where end users can easily find it.

    From a usability point of view, the web extensions system is a big step backwards.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

Please note that your comment may not appear immediately after you post it.