Permissions and Host Matching

Just like apps on your phone, browser extensions often need special 'permissions' to do their job. These permissions define what your extension can and cannot do.

This system is crucial for user security and privacy. It prevents extensions from accessing information or performing actions they don't need, without your explicit consent.

In Manifest V3, permissions generally fall into two categories:

• API Permissions: Access to specific browser features (e.g., managing tabs, saving data).
• Host Permissions: Access to specific websites (e.g., reading content on example.com).

We'll look at how to declare both in your manifest.json file.

API permissions are listed under the "permissions" key in your manifest.json. Each string in the array corresponds to a specific browser API.

For example, "storage" lets your extension save user data, and "tabs" allows it to interact with browser tabs (like getting their URLs).

The "activeTab" permission is unique. It's an API permission that grants your extension temporary host permissions to the currently active tab.

This access is granted only when the user *invokes* your extension (e.g., clicks its toolbar icon). It's a great way to reduce initial permission warnings, as access is only given when needed.

Host permissions are crucial for defining which websites your extension can interact with. Without them, your extension cannot read or modify content on web pages.

This is a major security boundary. An extension with host permission for google.com cannot access facebook.com, protecting user data and ensuring privacy.

Host permissions are declared in the "host_permissions" array in your manifest.json. You use URL match patterns to specify the domains.

A match pattern like "*://*.example.com/*" means access to all subdomains of example.com over HTTP or HTTPS.

Match patterns use special characters:

• *: Matches any string (except / in scheme/host, or # in path).
• <all_urls>: A special pattern that matches any URL (http, https, ftp, file). Use this with extreme caution as it grants wide access.

For example, "https://*.google.com/search?*" would match Google search results pages.

Often, your extension will need both API and host permissions. Here's an example for an extension that wants to execute a script on Wikipedia pages.

It needs the "scripting" API permission to run code, and host permission for Wikipedia to define where that code can run.

When a user installs your extension, the browser displays a list of all requested permissions. This is their chance to understand what your extension can do.

Always request the minimum necessary permissions. Over-requesting can make users distrust your extension and choose not to install it. Be transparent!

Which statements accurately describe host permissions in Manifest V3 extensions?

Great job! You've learned about the vital role of permissions in Manifest V3 extensions.

• API Permissions: Access browser features (e.g., "storage", "tabs").
• Host Permissions: Control website access using URL match patterns (e.g., "*://*.google.com/*").
• "activeTab" is a special API permission that grants temporary host access.
• Always request the minimum necessary permissions to build user trust.

Understanding these concepts is key to building secure and functional extensions!