Warning for add sessions permission

[Uladzimir Yankovich]

Colleagues, I need your help.

Does the sessions permission have a warning? The page https://developer.chrome.com/docs/extensions/mv3/permission_warnings/#permissions_with_warnings doesn't have it.

Will Chrome disable the extension if I add sessions to the manifest? Permissions history, all_hosts, tabs are already in the manifest.

I was sure it would turn off. And implemented a request for temporary permission. But on click, Chrome does not show any dialogs but gives permission.

[Jackie Han]

I use my tool to show warning messages. They are different.

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/ecd31255-cb64-43ac-aae3-aff75b8024fan%40chromium.org.

[Uladzimir Yankovich]

I used. But I described the situation to you, the request for a temporary permission does not cause a dialogue. How is this possible?

--

Uladzimir Yankovich,

Founder @ Manganum (manganum.app).

[hrg...@gmail.com]

That happens when the permission has been granted before and then removed. i.e. when you request the permission a second time, Chrome will grant the permission without asking the user.

Chrome has always behaved this way (at least for the past 8 years or so). It's quite an unintuitive behavior, though, and it's not documented anywhere.

However, it's not really a problem. Just be prepared for the permission to be granted instantly right after you request it.

[Jackie Han]

the request for a temporary permission does not cause a dialogue

 I only see the term "temporary" permission in the "activeTab" permission.

So, I think you mean optional permission. I did a test

  "permissions": [ "tabs" ],

  "optional_permissions": [
    "sessions"
  ],

  chrome.permissions.request({
    permissions: ['sessions']
  }, (granted) => {
    console.log(granted)
  });

Yes, there is no dialog. Chrome grants it automatically. I don't know why. The current implementation is that :)

[Uladzimir Yankovich]

Yes, and now try to conduct a similar experiment with permissions of favicon or bookmarks - you will see a dialog.

Does this mean that adding the sessions permanent permission will not disable the extension for current users?

Also, the sessions permission has no mention of a warning in either the API page or the warnings page.

[Uladzimir Yankovich]

By the way, Chrome's behavior that you re-get a permission without confirmation is documented here - https://developer.chrome.com/docs/extensions/reference/permissions/#step-5-remove-the-permissions

But I'm talking about first getting it after installation.

[Jackie Han]

 Does this mean that adding the sessions permanent permission will not disable the extension for current users?

I don't think so. Because the warning messages are different. And it really gets more power.

IMO, you should report a bug for no dialog problem.

[Robbi]

Why should the "sessions" permission set as "optional" show a warning when instead it generates no warning when added as a standard permission?

It would seem normal behavior; so add "sessions" directly into the "permissions" field without much thought.

[Uladzimir Yankovich]

How to test it? Do you have an example of such an extension?

[Robbi]

if THEY wrote it in the docs....
Anyway you can test it by:

1. using the tool created by @Jackie or...
2. creating two .crx files that represents the old version (with no session permission) and the new version (with session permission).

if you choose the second way follow these instructions.

It's important that two .crx files are generated using the same private key.

Then you have to drag&drop the first .crx file onto the extesions page ( chrome://extensions/ )

Then you have to drag&drop the second .crx file onto the same page.

If you see that the update disables the extension then you can request a change in the docs.

All chromium-based browsers allow you to create packaged extensions but not all browsers allow the installation of the latter.

I recommend the browser "SRWare Iron". If you don't like it, you can always uninstall it afterward.

[Uladzimir Yankovich]

Yes, I know this way and I tested it in Yandex.Browser - the extension was disabled. Now I repeated the experiment with SRWare Iron - the extension was disabled.

It is very strange. Adding a permission does not ask for confirmation. Installing an extension from the store with only "sessions" permission does not show any notifications at all. But adding it to the list of permanent permissions disables the extension on update.

🤯🤯🤯🤯🤯🤯🤯🤯

[Robbi]

In this case it is advisable to open a bug report.

Then THEY will decide if it is actually a bug or if it is the documentation that is poor.