Remove the "Read and change all your data on all websites" permission on browser extension.

[Yurii Korovko]

I noticed that developed extension has a "Read and change all your data on all websites" permission.

But I don't understand why so. I don't use "<all_urls>" on host_permissions or something like that.

I would like to leave only "Read" permission. Is there any ideas how could I achieve this?

here is my permissions

host_permissions: [

'https://*.gg.skin/*',

'https://*.steamcommunity.com/*'

],

permissions: [

'storage',

'cookies',

'tabs',

'notifications',

'declarativeNetRequest',

'declarativeNetRequestFeedback'

]

Would be grateful for any help, thanks!

[Oliver Dunk]

Hi Yurii,

The manifest you've shared would result in the following permission warning:

 

You can use this tool to test: https://github.com/GoogleChromeLabs/extension-update-testing-tool

Those are the warnings I would expect for the permissions you requested. With host permissions and declarativeNetRequest you could (for example) redirect certain requests happening on a page so I don't think it would be accurate to say your access is read only.

Hope this helps!

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/b770d77d-f7e3-4f10-8e5c-5e2b5d2d1870n%40chromium.org.

[wOxxOm]

You didn't show your content_scripts in manifest.json, which also contributes to host permissions. The documentation and the web store submission UI should do a better job of highlighting this info prominently.

[Yurii Korovko]

Hi Oliver! Thanks for the reply

Have tested it with https://github.com/GoogleChromeLabs/extension-update-testing-tool and it shows same permissions I mentioned above

and the thing is that even if I completely remove "declarativeNetRequest" from my extension, nothing changes

so probably something else causes those permissions

пятница, 18 августа 2023 г. в 15:38:03 UTC+3, Oliver Dunk:

[Yurii Korovko]

Here is a full manifest 

{

...

"background": {

"service_worker": "src/background/index.js",

"type": "module"

},

"action": {

"default_popup": "src/pages/popup/index.html",

"default_icon": {

"16": "icon-16.png",

"32": "icon-32.png",

"48": "icon-48.png",

"128": "icon-128.png"

}

},

"icons": {

"16": "icon-16.png",

"32": "icon-32.png",

"48": "icon-48.png",

"128": "icon-128.png"

},

"content_scripts": [

{

"matches": [

"https://*.gg.skin/*"

],

"js": [

"src/content/index.js"

],

"run_at": "document_end"

}

],

"web_accessible_resources": [

{

"resources": [

"icon-16.png",

"icon-48.png"

],

"matches": []

}

],

"externally_connectable": {

"matches": [

"https://*.gg.skin/*"

]

},

"host_permissions": [

"https://*.gg.skin/*",

"https://*.steamcommunity.com/*"

],

"permissions": [

"storage",

"cookies",

"tabs",

"notifications",

"declarativeNetRequest",

"declarativeNetRequestFeedback"

]

}

пятница, 18 августа 2023 г. в 16:30:39 UTC+3, wOxxOm:

[wOxxOm]

It doesn't show all sites here:

• Read your browsing history
• Block content on any page
• Display notifications

Try uninstalling the extension and install it again. IIRC there's a bug with revoking previous permissions after you reload the extension.