Use Manifest v3 for Firefox

[imdj]

One hiccup in adapting manifest v3 to Firefox is host_permissions. Chrome and Firefox handle thing differently in this case, Chrome before installation will prompt the user for confirmation to 'Add extension' with a summary of what it can access, while Firefox treats these permissions as opt-in where the user is expected after installation to manually visit the extensions page and grants its permissions [0]

[0] https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/

MV3 treats host permissions (listed in the extension manifest) as opt-in.

[imdj]

At the moment, Firefox users wouldn't get a prompt for host_permissions in manifest v3 and instead have to do the following post-install:

1. Go to about:addons
2. Click on the extension
3. Switch to the Permissions tab
4. Enable the optional permissions required

[imdj]

Another options is to programmatically request permissions using browser.permissions.request API from a user action like: browserAction popup

[imdj]

For some background:

• Making host permissions optional by default appears to be harmful for extensions with global host permissions w3c/webextensions#227
• https://discourse.mozilla.org/t/blog-post-manifest-v3-in-firefox-recap-next-steps/97372/7

For reference see:

• Permissions API: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/permissions/

[imdj]

According to this comment made by Tomislav Jovanovic (back in 26/6/2023)

Yes, we're developing an update to the install flow for MV3, that will enable users to choose which host permissions to grant, and the default will be checked (meaning granted) for extensions which ask for a limited number of hosts (likely up to 6-10).

Either way, we still need to handle the case of rejected permissions

[imdj]

Note

During initial testing, after all permissions are granted and the extension loaded successfully, fetching results failed with an error that look like this:

Content-Security-Policy: The page’s settings blocked the loading of a resource at https://hn.algolia.com/api/v1/search... (“default-src”).

Turns out we're also required to use background.js for fetch now:

XHR and Fetch

Content scripts can continue using XHR and Fetch by first making requests to background scripts. A background script can then use Fetch to get the data and return the necessary information to the content script. To avoid privacy issues, set the “credentials” option to “omit” and cache option to “no-cache”. In the future, we may offer an API to support the make-request-on-behalf-of-a-document-in-a-tab use case.

https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-migration-by-implementing-new-features-today/

[imdj]

Firefox's manifest v3 is ready.

But, due to to host_permissions being opt-in, which render the extension broken on first install, we'll stick with v2 on the AMO (addons.mozilla.org) listing for now to avoid any friction. Version 0.2.0 still uses manifest v2 but lays the groundwork for a smoother transition in the future by incorporating changes to permissions and using service worker.