Look up all domain access requests of Firefox extensions before installation - gHacks Tech News

Look up all domain access requests of Firefox extensions before installation

The Firefox web browser displays extra permissions that an extension requests during installation and won't proceed with the installation until you activate the add button.

Extra permissions may request access to specific domains or all sites on the Internet, to display notifications, or to access the browser tabs.

You may notice sometimes that Firefox lists only some of the domains an extension requests access. Firefox displays a number, e.g. 13 other domains, in that case.

The prompt offers no option to display the entire list of domains an extension requests access to. You see such a prompt on the screenshot below.

firefox extensions permissions

The page of the extension on the Mozilla website lists the very same permissions so that it is not possible to verify all domains an extension requests access to using it or the installation prompt.

While it is certainly better if extensions requests access to as few domains as possible to provide its functionality, it is a usability issue that you cannot look the information up prior to the installation.

Here is a quick guide on how to display all domains without installing the extension.

firefox-extension permissions manifestFirst the manual way:

  1. Go to the page of the extension on the Mozilla website or third-party website.
  2. Right-click on "add to Firefox" button and select the "Save link as" option.
  3. Save the extension file to the local system.
  4. Open the folder on the local device the extension was saved to.
  5. If you have Bandizip or comparable software installed, right click on the file and select one of the available extraction options.
  6. If you don't use a dedicated software for that, rename the file extension from xpi to zip.
  7. Extract the Zip archive using Explorer.
  8. Open the folder of the extracted archive.
  9. Open manifest.json in a plain text editor, e.g. Notepad.
  10. Check permissions; it lists all domains the extension requests access to and all other permissions the extension requests during installation.

Extension Source Viewer

extension source viewer

Now with the help of the Firefox add-on Extension Source Viewer. We reviewed the extension back in 2016, check out the review for additional details. Chrome users can install this extension to verify Chrome extensions. You may also want to check out our precautions to take before installing Chrome extensions guide.

  1. Install Extension Source Viewer in Firefox.
  2. Right-click on the extension page and select "View extension source".
  3. Select the manifest.json file to inspect it.
  4. Check the listed domain permissions.

Tip: You may use a web version of Extension Source Viewer if you prefer not to install an extension to check other extensions.

Closing Words

Mozilla should consider adding an option to the extension page on the Firefox website and the installation prompt to list all domains an extension requests access to. (via Reddit)

Summary
Look up all domain access requests of Firefox extensions before installation
Article Name
Look up all domain access requests of Firefox extensions before installation
Description
The Firefox web browser displays extra permissions that an extension requests during installation and won't proceed with the installation until you activate the add button.
Author
Publisher
Ghacks Technology News
Logo
Advertisement

We need your help

Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats or subscription fees.

If you like our content, and would like to help, please consider making a contribution:


Previous Post: «
Next Post: »

Comments

  1. Franck said on July 10, 2018 at 5:19 pm
    Reply

    Very useful, thanks a lot !

  2. Steve said on July 10, 2018 at 6:41 pm
    Reply

    Out of curiosity, does uBlock / uMatrix allow you to block sites that the extension is asking for?

    1. Pants said on July 13, 2018 at 8:47 am
      Reply

      Not with Web Extensions, as extension code is privileged. In legacy XUL it could.

      1. Ray said on July 13, 2018 at 4:54 pm
        Reply

        This is wrong.

        You can block extension web requests if you remove uBlock’s “behind-the-scene” scheme in the whitelist.

      2. Tom Hawack said on July 13, 2018 at 5:13 pm
        Reply

        @Ray, I don’t think so : “[…]uBO no longer can see network requests from other extensions”
        https://github.com/gorhill/uBlock/wiki/Behind-the-scene-network-requests

      3. Emily said on July 15, 2018 at 8:24 am
        Reply

        Firefox is doing everything it can to make it harder and harder to use its browser safely with respect to privacy.

      4. Pants said on July 16, 2018 at 4:46 am
        Reply

        @Emily – that’s a two edged sword. Would you like a rogue or hijacked extension messing with your other extensions? Either way, there are pros and cons.

  3. Tom Hawack said on July 10, 2018 at 6:58 pm
    Reply

    Worthy recall of extensions’ permissions and what they imply. Personally I tend to omit focusing on those permissions.

    I may be getting the ‘Extension Source Viewer” Firefox extension because web version mentioned in the article (CRX Viewer) doesn’t seem to work here…

    And to find the permissions of installed extensions there is of course Firefox’s about:debugging with all the installed extensions’ ID and UUID with a direct link to their Manifest URL

  4. Nit-pick said on July 10, 2018 at 7:01 pm
    Reply

    The ‘via Reddit’ link goes to one of your articles.

  5. Pants said on July 10, 2018 at 7:37 pm
    Reply

    For installed extensions you don’t need an extension, just go to about:debugging and open each manifest URL link in a new tab

  6. Amy Poeler said on July 12, 2018 at 2:08 am
    Reply

    For installed extensions, I just use the extension “Project Insight” which shows all the extensions you have and what permissions they have.

  7. Dennis said on July 12, 2018 at 3:25 am
    Reply

    I can’t get Extension Source Viewer to do anything, but the first method works for me.

    I didn’t realise until now that (some) extensions for Firefox would access undeclared domains!

    Thanks, Martin!

  8. rms said on July 13, 2018 at 12:48 am
    Reply

    @ Steve

    No. webextensions are on the same API, so what webext A is doing is not a job for uBlock or uM.

  9. EmilyM said on July 15, 2018 at 8:27 am
    Reply

    Firefox is doing everything it can to make it harder and harder to use its browser safely with respect to privacy. That’s why extensions can’t block network requests by other extensions anymore. Privacy is totally dead and the horse keeps being picked apart, bit by bit.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

Please note that your comment may not appear immediately after you post it.