A couple of things got overlooked in bug 1197420: - optional permissions are still behind a hidden pref, that pref needs to be flipped on desktop - putting the right strings into the permission prompt got dropped in a rebase, they need to be added - there are some optional permissions that we don't have permission strings for (e.g. cookies, webRequest, etc), we need to add strings for these (but still not show them as required permissions i guess?)

Regarding the third point above, here are the permissions that can be optional permissions but that we don't show permisison strings for as required permissions: "activeTab", "cookies" "idle", "webRequest", "webRequestBlocking" The rationale for not prompting for cookies, webRequest, and webRequestBlocking is that they are always paired with host/origin permissions. The rationale for idle is that it isn't really prone to abuse I guess? (especially without event pages...) I'm not sure about the rationale for activeTab. I'm not sure what we should do when these are requested as optional permissions. Shotgunning some needinfos to solicit opinions.

The whole point of the activeTab permission is that it doesn't show a permission string, which should encourage people from using it in preference to <all_urls>. As for what we should do when they're requested, we should probably just silently grant them.

So just because I was unsure, I tried a WebExtension to check the messaging and its not about the permission, but rather the host. Asking for the combinations: "host x", "host x and cookies" and "host x, cookies and webRequest" - all give the same prompt on installation. If adding in a new host prompts for a permission, then I would say we don't need to do anything more about permissions based on hosts.

It sounds like Kris and Andy are both in favor of not showing any prompt at all when an extension calls browser.permissions.request() without any origin permissions and all the regular permissions coming from the list in comment 1. I'd like to double check what Chrome does in this case but this makes sense to me and is easy enough to do...

Whoops, meant to comment earlier but Chrome silently grants the permissions from comment 1.

Comment on attachment 8857132 [details] Bug 1352152 Fix several issues with optional webextension permissions https://reviewboard.mozilla.org/r/129064/#review132134 ::: browser/modules/ExtensionsUI.jsm:220 (Diff revision 1) > + // If we don't have any promptable permissions, just proceed > + if (strings.msgs.length == 0) { > + resolve(); > + return; > + } > + Remove whitespace.

Pushed by aswan@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/cd0340131a74 Fix several issues with optional webextension permissions r=kmag