Will updating these permissions require users to re-enable the extension?

[Rory]

Hi there,

I'm making some major updates to the code in my extension.

I'm moving from the following permissions and manifest:

manifest 2

• cookies
• tabs
• webRequest
• alarms
• <all_urls>

to these (new in underline):

manifest 3

• cookies
• tabs
• storage
• unlimitedstorage
• identity
• background

I previously understood that updating to include any new permission will disable the existing userbase and they'll need to re-enable it, however, I have not found that to be the case - we added some permissions last year that did not impact our users at all. Is there a rule for which permissions will require a re-enablement and which won't?

I assume the above is too many things and will disable my existing 7000 users, requiring them to re-authenticate?

Thanks

Rory

[hrg...@gmail.com]

The rule is more or less like this: If the permission warnings are different, the extension will be disabled.

So, compare the output of these two lines:

chrome.management.getPermissionWarningsByManifest('{"name":"hi","version":"1","manifest_version":2,"permissions":["cookies","tabs","webRequest","alarms","<all_urls>"]}', console.log)

chrome.management.getPermissionWarningsByManifest('{"name":"hi","version":"1","manifest_version":3,"permissions":["cookies","tabs","storage","unlimitedstorage","identity","background"]}', console.log)

If they give different results, your extension will probably be disabled.

[Robbi]

No, your extension should not disable itself.

Remember that "background" permission, if not optional, shows a notification very similar to the ones generated by chrome.notification during the update.

For sure this happens on win 10. For other OS I don't know.

[Rory]

Hey Robbi - 

Your answer and the answer above yours are different. I ran the permissions console logs above and they do produce different messages. You are saying it should not disable though?

[Deco]

It is a common assumption that any new permission requires user consent, however this is not correct. Chrome uses a granular grading system for categories to identify if re-consent is required: https://support.google.com/chrome_webstore/answer/186213?hl=en-GB#zippy=%2Chigh-alert%2Cmedium-alert%2Clow-alert

This is covered under section 3 of the permissions documentation: "Chrome prompts the user if adding the permissions results in different warning messages than the user has already seen and accepted.". 

As you are triggering storage and unlimitedstorage, which are new permissions outside the granular ones that have already been granted, user consent will be requested again.

Cheers,

Decklin 

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/e6e38a7f-b403-43cc-8ba6-5f6c294624f3n%40chromium.org.

[Robbi]

@Rory

If you want the final answer do yourself a favor and install (just only a second choice) a browser like SRWare Iron or Comodo Dragon to check this out.

These two browsers (but possibly others as well) are based on Chromium but still leave the option to the user to install extension via .crx file.
You have to creates from the MV2 version a .crx file keeping the relative .pem generated aside.
Create a second .crx file from the MV3 version (this time using the previously created .pem file)
Drag the first .crx file to the extensions page (see if you want the message that appears with the required permissions)
then drag the other .crx relative to the new version to the same page and see what happens.
You will see that no more messages will appear!
Do you want proof?
Create a third version (and actual crx generated with the help of the same .pem file) adding a permission that will surely disable the extension (i.e "bookmarks")
and drag the .crx back to the extensions page.
You will see that this time the extension will be disabled and you will be specifically asked if you want to re-enable it.

[Rory]

Thanks for the detailed clarification everyone. Appreciate it.

[Travel Arrow]

Hi Rory,

What ended up happening with your update? We need the exact same permission additions.

Thanks a ton in advance!