nsPermissionManager has a custom logic for choosing the host name for a permssion [1]. Once i added a permission, i can access that host name via perms.getPermissionObject(...).host - but before adding it, there is no public interface for this. If we could have a public interface for that on the permission manager or the principal, i could get rid of the fragile approach of matching nsPermissionManagers host-choice with a separate implementation. Something like nsIPermissionManager::GetHostForPrincipal(outString) perhaps? [1] http://hg.mozilla.org/mozilla-central/annotate/a0c7e9f6c6be/extensions/cookie/nsPermissionManager.cpp#l120