How to know if permissions are safe to request in your Chrome Extension

Key Concepts

• Extension Permissions: Controls what an extension can do and what data it can access.
• Permission Warnings: Prompts displayed to users when an extension update requests new, potentially sensitive permissions.
• Host Permissions & Matches Patterns: Permissions related to the websites an extension can interact with. Updates to these can trigger permission warnings.
• Declarative Net Request Permission: A permission allowing extensions to block content on webpages.
• Extension Update Testing Tool: A tool for developers to simulate extension updates and preview permission prompts.
• Manifest File: The file containing the extension's metadata, including the permissions it requests.
• All URLs Permission: A broad permission granting access to all websites, potentially mitigating further permission prompts.

Understanding Chrome Extension Permission Updates & Testing

This video explains why Chrome sometimes disables extensions and asks users to re-approve permissions after an update, and provides a method for developers to test these updates before publishing. The core issue revolves around Chrome’s security measures to ensure users are aware of the capabilities of the extensions they are using.

Permissions and Their Impact

Chrome extensions operate within a defined set of permissions that dictate their functionality and data access. A comprehensive list of these permissions is available in the Chrome for Developers documentation. Requesting new permissions, particularly those flagged with warnings, often results in the extension being disabled upon update. Users are then presented with a prompt asking them to explicitly grant the new permissions before the extension can be re-enabled. As stated in the video, “These control what an extension can do and what data it has access to.”

The documentation clearly outlines the warning associated with each permission. For example, requesting the “downloads” permission triggers a warning stating “manage your downloads.” Permissions without listed warnings generally don’t require user intervention.

Beyond the Permissions Array: Host Permissions & Content Scripts

It’s crucial to understand that permission warnings aren’t solely triggered by changes to the permissions array in the extension’s manifest file. Updates to host permissions and matches patterns used by content scripts can also initiate these prompts. This means even if the permissions array remains unchanged, an update can still require user approval.

Chrome’s Permission Merging Logic

Chrome employs a complex logic system for merging permissions. It doesn’t always display all potential permission warnings, especially if the user has already granted broad permissions. The video illustrates this with the example of the “all URLs” permission. If a user has already authorized an extension to “read and change all your data on all websites,” requesting the “declarative net request” permission (which normally triggers a “block content on any page” warning) might not require an additional prompt. This is because the existing “all URLs” permission already covers a wider scope. The video acknowledges that documenting all these scenarios is impractical, hence the recommendation to use the testing tool.

Testing Updates with the Extension Update Testing Tool

To proactively assess the impact of permission updates, developers can utilize the Extension Update Testing Tool. This tool allows developers to simulate the update process and observe the permission prompts users will encounter.

Step-by-Step Process:

1. Basic Setup: Import the existing, published version of the extension into the tool.
2. Initial Install: Install the extension to confirm no permission warnings are present.
3. Update with New Permission: Modify the extension’s manifest file to include the new permission (e.g., “declarative net request”). Crucially, increment the version number in the manifest.
4. Upload Updated Version: Upload the updated extension to the testing tool.
5. Simulate Update: On the extensions page in Chrome, click the “update” button.
6. Observe Prompt: Verify that the expected permission warning is displayed, mirroring the experience users will have when updating from the Chrome Web Store.

As the speaker states, “take the version that’s already published, bring that into the tool, and then upload your new version. And you can use this to go through the full flow that a user would see and check that you’re comfortable with any permission warnings.”

Real-World Application & Example

The video uses the “declarative net request” permission as a concrete example. Adding this permission to an extension that already has “all URLs” permission may not trigger a new prompt, demonstrating Chrome’s permission merging logic. The testing tool allows developers to confirm this behavior before releasing the update.

Notable Quote

“If you don't see a permission warning listed here, then you can add the permission and there will be no impact to a user.” – This highlights that not all permissions require explicit user approval.

Conclusion

Understanding Chrome’s permission system and utilizing the Extension Update Testing Tool are vital for developers to ensure a smooth user experience during extension updates. Proactive testing allows developers to anticipate and address potential permission prompts, minimizing disruption and maintaining user trust. The key takeaway is to thoroughly test updates, especially those involving new or modified permissions, to understand the impact on users and avoid unexpected disabling of the extension.