Please Simplify Safari Extension Permissions

Question

Created Sep ’20

Replies 2

Boosts 1

Views 1.3k

Participants 2

Permissions are incredibly unintuitive. You have to keep clicking the toolbar icon to see if there's a new permission to allow. There's no alert, no notification, users just have to stumble upon it. It took me a while to figure out how to get things working, and I made it! No one else is going to have the same patience. In my case I'm making background xhr calls to pull content from third parties.

You can either allow permission for the day, always allow for just that site.. or allow it to run on every site on the internet. Please just automatically open the toolbar icon when a new permission is requested, and have an option to "always allow on requested sites" we explicitly list the sites we need access to in the manifest, if we only list 2 websites, why are you asking users to grant permission to every website they ever visit?

Answered by Accelerate_Media in 636454022

Thanks for the info @timothy.hatcher. My problem was trying to pull a cookie before those xhr calls. Requests for the cookies were silently failing before permissions were granted. I ended up just using a combination of permissions.contains and cookies.getAll(). This fixed both of my problems. I can now show my own error message letting users know to click the toolbar icon, and the cookies.getAll() will group every website listed in the permissions section of manifest.json and show "Always allow access to these websites".

Code Block jsbrowser.permissions.contains({origins: ['*://*.website.com/*']}, (granted) => {
    if (!granted){
        //useless call to group multiple sites into one request window.
        browser.cookies.getAll({});
        sendResponse({status:'FAIL', error:'Please click the toolbar button above to allow us permission to Website.'});
        return;
    }
});

Boost

Answer 1

Frameworks Engineer OP

Apple

Sep ’20

Performing XHRs in the background page do not require granted permission, you can connect to sites via XHR as long as they are included in the permissions or optional_permissions arrays.

Asking for permission from the toolbar item as the user visits sites is behaving correctly. The toolbar will badge with a warning icon the first time the user visits a site after enabling your extension to inform the user, and after that they need to know if the extension toolbar icon is not in color, that permission might be needed to use the extension on a site.

If you need to prompt the user for permission, you can use browser.permissions.request() with optional_permissions for a more explicit permission prompt.

0

Answer 2

Accelerate_Media OP

Sep ’20

Accepted Answer

Thanks for the info @timothy.hatcher. My problem was trying to pull a cookie before those xhr calls. Requests for the cookies were silently failing before permissions were granted. I ended up just using a combination of permissions.contains and cookies.getAll(). This fixed both of my problems. I can now show my own error message letting users know to click the toolbar icon, and the cookies.getAll() will group every website listed in the permissions section of manifest.json and show "Always allow access to these websites".

Code Block jsbrowser.permissions.contains({origins: ['*://*.website.com/*']}, (granted) => {
    if (!granted){
        //useless call to group multiple sites into one request window.
        browser.cookies.getAll({});
        sendResponse({status:'FAIL', error:'Please click the toolbar button above to allow us permission to Website.'});
        return;
    }
});

1