Firefox’s new WebExtensions permission system

Mozilla plans to turn on a permissions system for the installation of WebExtensions in the Firefox web browser that is similar to that of Google Chrome.

Whenever you install an extension in Google Chrome, all of the extra permissions that the extension requests are listed in the installation prompt.

The idea is to provide users with information on these extra permissions, so that abusive extensions can be avoided.

The main issue with the permissions system is that most users are probably ignoring the permissions prompt. One reason for that is that it is often difficult to find out whether a permission is really needed for functionality, or if it is simply there for marketing or outright malicious purposes.

Firefox's new WebExtensions permission system

Mozilla plans to launch similar installation permissions in Firefox 54 at the earliest, but most likely in Firefox 55.

Firefox will display the extra permissions an extension requires during installation. The current iteration lists all permissions, but no additional information about them in the interface.

The permissions come from the manifest.json file of the extension. If you open it in a plain text editor, or a special json viewer (for instance the json viewer of Firefox), you find them listed under the permissions section. This is true for Chrome and Firefox WebExtensions. Please note that you need to extract the extensions file first to get a listing of files included.

Google published a page that lists all optional Chrome permissions that extensions may declare, and Mozilla published one as well. The permissions are not identical at this point in time, and it seems unlikely that they will ever be identical. Mozilla plans to support more APIs, and with that may come extra permissions that only Firefox supports.

The installation prompt listing the permissions the extension requires is triggered whenever a WebExtension is installed in Firefox. This includes installations from Mozilla AMO and third-party websites, extensions that get side-loaded, and during upgrades.

Firefox users who are interested in the feature can enable it right now. Please note that this landed in Firefox 53 Nightly, and that the permission does not exist by default (yet).

If you run at least Firefox 53, you may do the following to enable the permission prompts when installing WebExtensions in the Firefox web browser:

1. Load about:config in the Firefox address bar and hit the Enter-key.
2. Confirm that you will be careful if the warning page opens.
3. Right-click in the main area on about:config, and select New > Boolean.
4. Name that Boolean extensions.webextPermissionPrompts.
5. Set it to true.

Any WebExtension installation afterwards triggers the installation prompt that highlights the requested permissions.

The main tracking bug for the feature is 1308292. Additional information is provided on Mozilla's Wiki website.

While we are at it: check out Firefox's permissions manager, and the new permissions system that Mozilla plans to launch.

Now You: Do you find the installation prompts useful?