-
Notifications
You must be signed in to change notification settings - Fork 122
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Permission requirements now include "Access browser tabs"; document required permissions #439
Comments
The idea about documenting the permissions and why they are requested in the README is a good one! For now I'll just write a few notes about the specific one right here as this may change a lot in the near future as we are transitioning to Manifest v3 due to (primarily) Chrome pushing that platform very soon. The tab and tabs permission are requested in order to read the URL of the primary page when Consent-O-Matic is run for a popup in an iframe inside another page. In this case we read the URL of the parent tab (not the iframe) to see if the user has disabled CoM on this page. There is a difference between how Firefox and other browsers handles calls into the background script from iframes. Both Chrome and Safari provide the caller tab URL when the tab permission is requested but Firefox also needs the tabs permission. Whether this is a bug in Firefox is a good question. |
In the next release the requested permissions are now documented in the README.md (the frontpage of the git repository) and are also documented in the extension as part of the new onboarding step if the permissions haven't been granted by the user as part of the installation. It describes the 3 primary permissions requested:
|
Since this is privacy-oriented software it would be good to absolutely minimise the required permissions and, where it is not possible, to document to the user the reason for each permission.
A recent upgrade introduced the "Access browser tabs" permission in Firefox, but the reason was not immediately clear. I traced it to commit c8f5057 which justifies it as necessary for iframes (not tabs).
The text was updated successfully, but these errors were encountered: