-
Notifications
You must be signed in to change notification settings - Fork 32
Authenticated downloads and request context
Save In can use an existing browser session when it saves a resource, but it cannot replay every part of the page's original request. The result depends on how the download is acquired.
The normal path passes the resource URL to the browser's downloads.download() API. For HTTP and HTTPS URLs, the browser sends cookies that are applicable to the URL and the selected browser cookie store. Existing browser-managed authentication may also apply.
This is a new GET request. It does not copy a page's POST body, JavaScript-generated Authorization header, service-worker state, local/session storage, or other transient request data.
When the Referer option is enabled and its filter matches, Firefox can explicitly attach the current HTTP(S) page URL to a direct browser download. Chrome rejects this header for extension-owned downloads, so Save In fetches the protected content first and gives Chrome the resulting local Blob. The preset covers Pixiv and MangaDex image hosts; add other protected media hosts narrowly as needed.
Fallback fetching, :sha256:, or the Download through the extension (Fetch API) option may make Save In fetch the resource first and then give the resulting Blob URL to the downloads API.
By default, new and upgraded installations make these extension-context requests with credentials: "include". Use website sign-in cookies for extension requests controls Fetch and metadata requests; turn it off to use credentials: "omit" and make those extension requests anonymous. When enabled, the browser includes applicable cookies and browser-managed credentials. Save In never reads, stores, or exposes the raw cookie values.
The fetch is still extension-originated rather than a replay of the page request. Cookie SameSite and partitioning rules, third-party-cookie settings, private-browsing separation, and the selected cookie store can change which credentials are available. When the Referer option and filter match, both browsers temporarily attach the page URL only to the exact Save In metadata or content request, then remove the session rule. Once the bytes have been fetched, the Blob download itself does not contact the original server again.
Direct Firefox downloads automatically keep the originating tab's private-download-manager context. Save In does not request the cookies permission and does not select a Firefox cookieStoreId.
Extension Fetch cannot select the originating Firefox Container or private cookie store. A fetched Blob from a private tab remains associated with Firefox's private download manager, but the preceding extension Fetch cannot reconstruct the tab's private cookie jar. Authentication that exists only in a Container or private session may therefore be unavailable.
- POST bodies or form submissions
- Page-generated
Authorizationor other custom headers - Page JavaScript, service-worker, local-storage, or session-storage state
- One-time request state that is not encoded in the URL or a browser cookie
- The page Referer unless the optional Referer filter matches the exact Save In request
- A Firefox Container or private-cookie context on the Fetch-to-Blob path
Signed or temporary URLs can still work when all required authorization is encoded in the URL and remains valid long enough for the new request.
- Check History's mechanism field to see whether the save used the downloads API directly or fetch plus downloads API.
- Prefer a direct download when Firefox private-session authentication matters.
- If the extension must fetch the bytes first, confirm Use website sign-in cookies for extension requests is enabled and retry. SameSite, partitioning, and third-party-cookie rules can still prevent a cookie from being sent.
- Enable the Referer option and restrict its match filter to servers that require the page URL.
- If a resource is authenticated only inside a Firefox Container, Save In cannot currently reproduce that Container context.
Do not include cookies, private signed URLs, or authentication headers in public issue reports. See Troubleshooting and diagnostics and Page Sources.