{"id":7417,"date":"2015-03-13T09:23:29","date_gmt":"2015-03-13T16:23:29","guid":{"rendered":"http:\/\/blog.mozilla.org\/addons\/?p=7417"},"modified":"2015-03-13T09:23:29","modified_gmt":"2015-03-13T16:23:29","slug":"domain-whitelisting-disabled-non-https","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/","title":{"rendered":"Firefox 37 &#8211; Domain whitelisting disabled for non-HTTPS pages"},"content":{"rendered":"<p>If you have installed add-ons from sites other than <a href=\"https:\/\/addons.mozilla.org\/\">AMO<\/a>, you might be familiar with the domain whitelist. When you try to install an add-on from a third party site, you&#8217;ll see a doorhanger notification asking you if you want to allow that site to install software. The domain whitelist in Firefox allows you remove that notification for specific domains, which is useful if you install add-ons frequently from those domains.<\/p>\n<p>A recent security bug fix in Firefox changed the way the whitelist works. Starting with Firefox \u00a037 (to be released on March 31st), the doorhanger notification will always show up if you try to install an add-on from a page that is loaded with a plain HTTP connection. In other words, the domain whitelist will only work if the page the add-on is installed from is HTTPS. The URL to the XPI can still be plain HTTP, but the page that triggers the installation must be HTTPS.<\/p>\n<p>The &#8220;extensions.install.requireSecureOrigin&#8221; preference can be set to <code>false<\/code> in order to revert this change. Also, this doesn&#8217;t affect automatic add-on updates in any way, even if they happen over plain HTTP.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you have installed add-ons from sites other than AMO, you might be familiar with the domain whitelist. When you try to install an add-on from a third party site, &hellip; <a class=\"go\" href=\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/\">Read more<\/a><\/p>\n","protected":false},"author":173,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[388,44,295],"tags":[278877,278873,278876,278861,7105],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Firefox 37 - Domain whitelisting disabled for non-HTTPS pages - Mozilla Add-ons Community Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jorge Villalobos\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/\",\"name\":\"Firefox 37 - Domain whitelisting disabled for non-HTTPS pages - Mozilla Add-ons Community Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#website\"},\"datePublished\":\"2015-03-13T16:23:29+00:00\",\"dateModified\":\"2015-03-13T16:23:29+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/a098261b4b5510d408ff31f492606925\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/addons\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Firefox 37 &#8211; Domain whitelisting disabled for non-HTTPS pages\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/\",\"name\":\"Mozilla Add-ons Community Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/addons\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/a098261b4b5510d408ff31f492606925\",\"name\":\"Jorge Villalobos\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6d1966118f16e4b99a6e3ad07883be33?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6d1966118f16e4b99a6e3ad07883be33?s=96&d=mm&r=g\",\"caption\":\"Jorge Villalobos\"},\"description\":\"Jorge is the Product Manager for addons.mozilla.org\",\"url\":\"https:\/\/blog.mozilla.org\/addons\/author\/jvillalobosmozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Firefox 37 - Domain whitelisting disabled for non-HTTPS pages - Mozilla Add-ons Community Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/","twitter_misc":{"Written by":"Jorge Villalobos","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/","url":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/","name":"Firefox 37 - Domain whitelisting disabled for non-HTTPS pages - Mozilla Add-ons Community Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/addons\/#website"},"datePublished":"2015-03-13T16:23:29+00:00","dateModified":"2015-03-13T16:23:29+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/a098261b4b5510d408ff31f492606925"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/addons\/2015\/03\/13\/domain-whitelisting-disabled-non-https\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/addons\/"},{"@type":"ListItem","position":2,"name":"Firefox 37 &#8211; Domain whitelisting disabled for non-HTTPS pages"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/addons\/#website","url":"https:\/\/blog.mozilla.org\/addons\/","name":"Mozilla Add-ons Community Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/addons\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/a098261b4b5510d408ff31f492606925","name":"Jorge Villalobos","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/addons\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6d1966118f16e4b99a6e3ad07883be33?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6d1966118f16e4b99a6e3ad07883be33?s=96&d=mm&r=g","caption":"Jorge Villalobos"},"description":"Jorge is the Product Manager for addons.mozilla.org","url":"https:\/\/blog.mozilla.org\/addons\/author\/jvillalobosmozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts\/7417"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/users\/173"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/comments?post=7417"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/posts\/7417\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/media?parent=7417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/categories?post=7417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/addons\/wp-json\/wp\/v2\/tags?post=7417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}