Mozilla Add-ons Community Blog
Categories: developers webextensions

Extensions button and how to handle permissions in Manifest V3

39 responses

Manifest V3 (MV3) is bringing new user-facing changes to Firefox, including an extensions button to manage installed and enabled browser extension permissions (origin controls), providing Firefox users control over extension access to their browsers. The first building blocks of this button were added to Nightly in Firefox 107 and will become available with the general release of MV3 in Firefox 109.

Extensions button

The extensions button will give Firefox users direct control over website specific extension permissions.

In MV2, host permissions are granted by the user at the time of install and there’s no elegant way for the user to change this setting (short of uninstalling/reinstalling and choosing different permissions). But with the new extensions button in MV3 in Firefox, users will have easy access and persistent control over which extensions can access any web page, at any time. Users are free to grant ongoing access to a website, or make a choice per visit. To enable this, MV3 treats host permissions (listed in the extension manifest) as opt-in.

The button panel will display the user’s installed and enabled extensions and their current permission state. In addition to managing host permissions, the panel also allows the user to manage, remove, or report the extension. Extensions with browser actions will behave similarly in the toolbar as in the panel.

Manifest V2 (MV2) extensions will also display in the panel; however users can’t take actions for MV2 host permissions since those were granted at installation and this choice cannot be reversed in MV2 without uninstalling the extension and starting again.

You can also find more information about the extensions button from support.mozilla.org

How to deal with opt-in permissions in extension code

The Permissions API provides a way for developers to read and request permissions.

With permissions.request(), you can request specific permissions that have been defined as optional permissions in the manifest:

const permissionsToRequest = {
  permissions: ["bookmarks", "history"],
  origins: ["https://developer.mozilla.org/"]
}

async function requestPermissions() {
  function onResponse(response) {
    if (response) {
      console.log("Permission was granted");
    } else {
      console.log("Permission was refused");
    }

    return browser.permissions.getAll();
  }

  const response = await browser.permissions.request(permissionsToRequest);
  const currentPermissions = await onResponse(response);

  console.log(`Current permissions:`, currentPermissions);
}

This is handy when the request for permissions is tied to a user action like selecting a context menu item. Note that you cannot request for a permission that is not defined in the manifest.

Other times, you’ll want to react to a permission being granted or removed. This can be done with permissions.onAdded and permissions.onRemoved respectively.


function handleAdded(permissions) {
  console.log(`New API permissions: ${permissions.permissions}`);
  console.log(`New host permissions: ${permissions.origins}`);
}

browser.permissions.onAdded.addListener(handleAdded);

Finally, you can check for already existing permissions in two different ways: permissions.getAll() returns a list of all granted permissions and permissions.contains(permissionsToCheck) checks for specific permissions and resolves to true if, and only if, all checked permissions are granted.


// Extension permissions are:
// "webRequest", "tabs", "*://*.mozilla.org/*"

let testPermissions1 = {
  origins: ["*://mozilla.org/"],
  permissions: ["tabs"]
};

const testResult1 = await browser.permissions.contains(testPermissions1);
console.log(testResult1); // true

We always encourage feedback from our developer community, so don’t hesitate to get in touch:

39 comments on “Extensions button and how to handle permissions in Manifest V3”

  1. Max wrote on

    I am not a fan of a unified extensions button. I like my extensions lined up on the extensions toolbar where I can see them and interface with them and I want them to stay there. If that bar goes away, I will stop updating Firefox at that version. Humbly yours, FF user since FF 31.8.0.

    1. Juha-Matti Santala wrote on

      The toolbar isn’t going away. You will still be able to pin your extensions to the toolbar and interact with them.

      You can have your most used extensions in the toolbar for easy access while having a convenient way to provide permissions for all extensions through the Unified Extensions Button.

  2. Habi wrote on

    So if a user installs an add-on that for example changes the background color of all websites. Nothing will work out of the box and no permission request dialog or anything similar will appear even if the user opens a website, right? Users somehow need to know that they have to manually grant the permission through the new extension button.

    I really would like a system were Firefox automatically asks if the user wants to allow the add-on to run on a website when visiting it the first time. There could be an option like “don’t ask again” to avoid spamming this dialog. This would make the user aware that the extension has additional requirements. Otherwise I can already see a lot of users complaining that the add-on does not work while the reason is simply an uncommunicated missing host permission.

    1. Juha-Matti Santala wrote on

      Hey Habi!

      > Nothing will work out of the box and no permission request dialog or anything similar will appear even if the user opens a website, right?

      The “anything similar” is kinda where we are with Unified Extensions Button.

      For an MV3 extension that needs a permission to run on a site, there will be an indicator for permission request for the host in the Unified Extensions Button (or below the toolbar icon if the extension is pinned to toolbar).

      Currently there’s no pop up that would pop up to ask for it. We’ll gather feedback as it rolls out and especially once there will be more MV3 extensions in the market as that’s when we can see how well the current system works and how quickly the users learn the new system.

  3. Mark wrote on

    I have 50+ extensions. (That Extensions Button is really “great” for managing them. But OK. Maybe there won’t be any need for using it even for the permissions.)

    But I need to interact only with 10 of them. From time to time. So I don’t want to be permanently distracted by 10! icons on the toolbar (moreover when couple of them is animated or informative the way I don’t need). But now it’s the only place where I can put them.

    The Overflow/Extended >> menu was so great for them. Why is it made impossible to move the extensions there and thus they have to stay on the toolbar? The >> menu will stay there for FF buttons – why not for extensions buttons?!

    I hate the change. And I’m definitely staying with the FF version when it is still possible to move extensions to the >> menu .

    1. Juha-Matti Santala wrote on

      Thanks for the feedback Mark!

      With the changes in how permissions for extensions are granted in MV3 compared to MV2, we need to provide the users an easy way to see that there are pending permissions requests and a way to interact with them and that’s why we developed the Unified Extensions Button.

      We’ll be listening to feedback like yours as we keep developing the functionality further.

      1. Mark wrote on

        Thanks for the answer.

        How I understand it, it is all done for the need to display a request for permissions. Then it’s so easy to imagine that the same indicator could be shown on the Overflow menu like on the Extensions Button and very similarly the request for permissions. You are not even dependent on the Extensions Button as you’re trying to make an impression because you allowed to move extension buttons to the toolbar.

        Do you think people would not understand? Who managed to move an extension to the Overflow menu would almost certainly got the information about permissions given by any reasonable way. Yet you just deleted extensions from the Overflow menu. Now you cannot even test it! I think you are just making it easier for yourselves…

        1. Juha-Matti Santala wrote on

          Thanks for the follow up, I appreciate you taking the time to provide your feedback!

          > How I understand it, it is all done for the need to display a request for permissions

          Well, kinda. In addition to displaying the requests, it’s also a one-stop-shop to see granted permissions and manage those permissions.

          > Then it’s so easy to imagine that the same indicator could be shown on the Overflow menu like on the Extensions Button and very similarly the request for permissions.

          That could be another approach, yes. Where the Unified Extensions Button should be and what are all the places extension buttons could live, is a question with many opinions by different users. We came to the conclusion that making it visible and mandatory was the best approach, especially as we are entering the transition from MV2 extensions to MV3 extensions.

          Since this is quite a major change in how things change with MV3, we wanted to make it easy for users to understand. There are users of all kind, some might not even know that they have extensions installed and we want to add clarity to them as the MV2 to MV3 transition happens that there are new steps to take and to make it clear how it affects the permissions.

          > You are not even dependent on the Extensions Button as you’re trying to make an impression because you allowed to move extension buttons to the toolbar.

          I’m not sure what you mean by making an impression here. We wanted to maintain the ease of use with those extensions that users use the most so the ability to pin them into the toolbar is crucial.

          The big change is that in the past, there were a lot of extensions that didn’t have any interaction (for example, only running content scripts on page load). Now with MV3’s permission system and optional host permissions, we need to bring those into the mix in a way that is easy for the users to interact with and understand.

          > Now you cannot even test it! I think you are just making it easier for yourselves…

          Can you elaborate on the testing part, I’m not sure what you are referring to? I can assure that the decision was made with our users in mind, not to make it easier for ourselves.

          1. Mark wrote on

            I got it all. The only problem for me is that even though you allowed extensions to be pinned to the toolbar (and it was absolutely necessary), you made impossible for those pinned extensions to be moved to the Overflow menu. Just one more possibility. And the one crucial for me.

            (And when an extension is pinned to the toolbar, it disappears from the Extensions Button menu. The Extensions Button is not needed for that extension anymore. Then it’s clear you managed to solve every new needed interaction with the extension without the Extensions Button. Then you can solve it with some extensions placed in the Overflow menu, too. Just if you want.)

            (And the testing: You cannot test if some solution works for the people who choose to use the Overflow menu when you just forbid it.)

  4. Mark wrote on

    Do I understand right that my comment was simply deleted without an answer? Does it really go this way in Firefox now?

    1. Juha-Matti Santala wrote on

      Hey Mark!

      Your comment was in the approval queue and we do not go through that on weekends. Sorry for the misunderstanding there.

  5. Jose wrote on

    Will there be a way for ESR to have the permissions by url capability disabled?

    1. Juha-Matti Santala wrote on

      Hey Jose!

      The current ESR (114) won’t have support for MV3 extensions and won’t have this Unified Extensions Button.

      If you mean for the next one (115, coming next July), do you mean disabling the ability to grant permissions to be always available for an URL or disabling the need to give permissions for each URL separately?

      1. Jose wrote on

        I was asking if ESR would have the ability to disable giving permissions for each URL separately by a user.

        So v3 extension support will not be available in ESR until ESR 115, correct?

  6. Chris wrote on

    The new unified button is awful. How is this something that users should be excited about when it forces you to deal with an un-customizable list of all your installed extensions?

    Before I had a handful of extension inside my Overflow menu, and the extension I didn’t want were hidden. Now I have to deal with the new button. You can pin buttons to the toolbar, yeah, but it doesn’t even allow you to drag the icon inside the overflow menu or even hide the new extension button.

    What the point of the overflow menu now? Who the heck comes up with all these stupid ideas?

    1. Juha-Matti Santala wrote on

      Hey Chris!

      Thanks for your feedback, I’ve passed it to our team. I’m sorry to hear this feature is not to your liking.

  7. Chris wrote on

    It’s nice to see that Mods here mute all the negative comments.

    1. Juha-Matti Santala wrote on

      Hey Chris!

      We do not mute nor delete negative comments. Comments have a manual approval process so it occasionally takes a short while to appear in the blog.

  8. Andraste Melánie wrote on

    How to remove the Unified Extensions Button from the toolbar? Its greyed out.

    1. Juha-Matti Santala wrote on

      Hey Andraste!

      Currently there is no way to remove the button. If there are no extensions enabled, clicking it will lead to about:addons.

    2. Finn wrote on

      about:config, search for extensions.unifiedExtensions.enabled. and set it to false. Temporary solution but at least its something.

  9. Omar Enrique wrote on

    I think the new button is excellent, just for that reason I installed firefox developer edition
    But… it could be improved, add the option to enable and disable extensions from the same menu, without having to open the extension management window, and also to show all extensions, not only those that are enabled, in chrome there is an extension that does all this, but that firefox implements it natively is already a plus that makes it superior to chrome
    Please, I hope you can consider these suggestions.
    Greetings from Bolivia

    1. Juha-Matti Santala wrote on

      Hey Omar!

      Thank you for your feedback, happy to hear from you. I’ve passed your suggestion to our team for consideration.

  10. Pavel wrote on

    I have one notice – the order of extensions in the unified button is kept from the overflow list and added others to the end of it, and that’s good for now. Still, I think that the opportunity to manually change the order of extensions is needed for convenience as now that list contains every extension and not selected ones as it was possible before.

    1. Juha-Matti Santala wrote on

      Hey Pavel!

      Thanks for the feedback, I passed it along to our team.

    2. Paweł wrote on

      I hope you will not double down on basically killing the only feature of the overflow menu. I get the need to have a better way to handle permissions with MV3 and the creation of a separate button. The problem I have is that, the new section doesn’t allow for the items to be reordered. I have a lot of extensions and being forced to scroll through a VERY LONG list with MUCH BIGGER items, than they were in the overflow menu is painful. To add insult to injury, there is this very big useless settings cog button right next to every extension, that serves no purpose as it just opens the right click context menu. It appears to me as a visual clutter. It is even styled incorrectly, because if the text about permissions of extensions is too long, it goes underneath the button, which hides a part of it before the text wraps to a new line.

      Another thing, is that even thought you said, the new menu was needed to display current permissions of the extension, it doesn’t do that consistently. Items not kept on the toolbar are not shown in the menu, so you can’t quickly check their permissions unless you resize the browser window to be really narrow to force them to overflow (NOT TO THE overflow menu) to the new ext. menu which is an inconsistent UX.

      Example of what I would consider a fix in this situation:
      – allow for old overflow menu behavior to coexist with the new menu (let it work as before without changing anything)
      – make the new ext. menu show every extensions in the following order:
      LTR extensions pinned to toolbar -> user defined order in overflow menu -> extensions that don’t expose UI icon to the browser that act as background scripts in install time order
      – remove any functionality from new ext. menu that allows for interaction with extension exposed function (custom right click entries, clicking the icon, etc.) to prevent duplication with overflow menu
      – change the icon of the new ext. menu icon from puzzle piece to a puzzle piece icon with a shield in the lower right corner, or any other combination of those two pictograms and call it an extension’s permissions button
      – add an option to move/hide this extension’s permissions button through Firefox built in way to customize item layout
      -profit

      We were able to live without these permissions shown every time for decades, so why start pushing it now?

      1. Juha-Matti Santala wrote on

        Hey Pavel and thanks for the follow up!

        I’ll answer the direct questions right away as that is what we have an answer for and the rest I’ll make sure gets added to our feedback list.

        > Another thing, is that even thought you said, the new menu was needed to display current permissions of the extension, it doesn’t do that consistently.

        You are correct, I was incorrect there. As you said, extensions pinned to toolbar won’t be visible in the Unified Extensions Panel. In case of those extensions needing permissions, they will have their own identifier marker below their button.

        > We were able to live without these permissions shown every time for decades, so why start pushing it now?

        The permissions system changes with MV3: in the MV2 system, all host permissions were granted at install time so there was no need to have a panel to interact with them as the only way to revoke a permission was to uninstall the extension.

        With MV3, all host permissions become optional, providing the user a way to more granularly grant permissions: they can allow it to run per visit when clicked, always on a given domain or always on all sites.

        This also means that there’s a need to be able to interact with MV3 extensions that don’t have a browser action to grant permission to them. In 108 and older, there’s no way to pin such extension to toolbar/overflow menu as there was nothing they would do there.

        And because this is a new thing, it’s important for us that all users are able to notice a permission request and be able to grant permission.

        1. Paweł wrote on

          Oh, I didn’t notice Pavel before, I am completely different – Paweł . I meant you as collectively Mozilla, so that may have caught you off guard.
          I know that MV3 becomes a thing (which brings more bad than good, but that’s just my opinion) and that a browser must let user manage permissions.
          I just would like to have a way to keep the old workload intact, so I would just let extensions work as if they were MV2 extensions (letting them do their thing without getting into my way). Only occasionally would I leverage new MV3 features. Old habits die hard.

          Now that I think, the best place for my imagined before castrated “Unified Extensions Button” would be as sub menu inside the “shield menu” at the beginning of address bar. Permissions after all are privacy measures, so for me it makes sense to decouple extension functionality from it’s permissions. Permissions should be and are controlled by a browser and functionality is provided by ext. developer – two different entities.
          This way the old overflow menu would be left intact and permissions would have it’s own special thing, that wouldn’t go in a way of a user as I feel it now is.

          Either way I hope you are not going to settle for mostly the same thing as it is now, because it’s a terrible downgrade.

          1. Paweł wrote on

            Oh sorry, I have made a reply, not a new comment. That’s why you mixed me up. Only now after clicking send have I realized it. If it’s a problem please move my replies to a separate comment (if that is possible). Again sorry for the inconvenience.

          2. Juha-Matti Santala wrote on

            Hey Paweł!

            My apologies for not realizing you were different person, I just glanced at the name. No worries about the inconvenience!

            I appreciate your feedback and will bring it to our team as we develop the feature further.

  11. Pascal wrote on

    Can you add an option to also move the addons in that list to any spot I like?`For around 8 of my 16 extensions I need to interact with them from time to time and previously I was just able to only see those in the overflow menu. Now I understand why this change happened and that we need to see all of our extensions, it would still be great to sort them naually so I see my important extensions on the top.

  12. curious user wrote on

    Hello. If you give a resource-intensive extension like Dark Reader permission to access only a specific site, will it be completely “idle” until you open that site? Or will it somehow still use your CPU even when you’re not on that site?

    1. Juha-Matti Santala wrote on

      Hey!

      It depends on what the extension does. For extensions like Dark Reader that do most of their work in the content scripts, the resource use will be reduced when you are not on that site.

      Extensions can still do things in the background script so they might not be completely idle on these situations.

  13. Mark wrote on

    Please bring back the overflow menu or the ability to hide some extensions from the extensions dropdown. Or at least let us re-order the extensions in that menu. I have 20-30 extensions and the new dropdown is now unusable, I have to scroll and hunt the extension I want to interact with. I know you can still pin some extensions to the toolbar but I like to keep my toolbar as clean as possible with only my most used extensions. Before you could add your seldom used extensions to the overflow menu but you can’t do that anymore. It’s very cluttered the way it’s done now.

  14. Dre wrote on

    Wait is there no way to move and organize extensions in the new menu? I like my extensions in the overflow menu but organized. Please god tell me you didn’t remove this function!

  15. krrr wrote on

    I think the lack of customization is the biggest problem of this new menu, and users definitely *will* complain about it. So, that’s what do I suggest:

    https://connect.mozilla.org/t5/ideas/unified-add-ons-ui-improvements/idi-p/20964

  16. Samuel wrote on

    My main gripe is that while I don’t mind that it was put there automatically, but the fact I can’t move it, remove it, or otherwise do anything with it makes it feel infuriating. Taking away a user’s agency to customize their browsing experience after establishing a clear precedent of being able to do so is not a great idea.
    When an Extension needed updated permissions before hand, it would notify me in the Application Menu, and even add a little yellow notification dot onto the icon. Something similar would probably work here as well, I imagine.
    This is a beta at the end of the day, so I hope this can be addressed before the general population of users comes here to complain about it too.

  17. Mic wrote on

    Please give option to remove this button.

  18. Finn wrote on

    I strongly dislike this move to a “Unified Extension Button”. It is one of my least favourite features in Chrome. I have a lot of extensions, some of which I never interact with. I like being able to dump those either at the bottom of the overflow menu or hide them entirely. This new menu not only forces you to see all extensions, but it also does not allow any organisation from what I can tell. Please allow some customizability with this, It is absolutely awful as it stands now.