Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce permissions requested by the browser extension #3055

Open
antross opened this issue Oct 1, 2019 · 1 comment
Open

Reduce permissions requested by the browser extension #3055

antross opened this issue Oct 1, 2019 · 1 comment

Comments

@antross
Copy link
Member

antross commented Oct 1, 2019

Currently the browser extension needs to request some fairly all-encompassing permissions:

  "permissions": [
    "<all_urls>",
    "webNavigation"
  ],

This results in a prompt similar to the following stating that webhint can "read and change all your data on the websites you visit" (which some users may find scary/surprising):
image

As a developer tool this is somewhat expected, but I think we can do better and avoid this warning by routing all page access through the devtools extension APIs and removing the content and background scripts (still need to test and confirm this). Then the extension only gets access to the page when the devtools are open (which is all it truly needs).

@antross
Copy link
Member Author

antross commented Oct 17, 2019

Update: testing has shown that Chromium browsers also display the "Read and change all your data on the websites you visit" text when a "devtools_page" is specified in the manifest (which webhint absolutely must have to function). Unfortunately that means we can't avoid the prompt there.

However we have a similar prompt in Firefox which lists three items:
image.png

Here we can reduce the three items to just one: "Extend developer tools to access your data in open tabs" by making the changes proposed in this issue.

@molant molant removed this from the 1910-2 milestone Oct 22, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants