Details for the webRequestAuthProvider permission #30188

rebloor · 2023-11-10T17:39:13Z

Description

Adds the webRequestAuthProvider permission to the permissions manifest key.
Add a note about support for webRequestAuthProvider permission in Chrome to webRequest.onAuthRequired
various edits to webRequest.onAuthRequired

Motivation

Provide documentation for the Chrome permission.

Additional details

BCD provided in mdn/browser-compat-data#21216.

Related issues and pull requests

Fixes #21586

github-actions · 2023-11-10T17:42:40Z

Preview URLs

External URLs (3)

URL: /en-US/docs/Mozilla/Add-ons/WebExtensions/API/webRequest/onAuthRequired
Title: webRequest.onAuthRequired

https://bugzilla.mozilla.org/show_bug.cgi?id=1820569 (1 time) (Note! This may be a new URL 👀)
https://crbug.com/1510405 (1 time) (Note! This may be a new URL 👀)
https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2023-12-11 22:01:19)

jpmedley

This was a nice bit of editing. You made some fixes most don't even know to do. I have one nit, but it's kind of an important one. We put compatibility notes in the data itself so that it is available to client applications.

jpmedley · 2023-11-13T15:29:01Z

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md


 See [Examples](#examples).

 If you use `"blocking"` you must have the ["webRequestBlocking" API permission](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#api_permissions) in your `manifest.json`.

-If your extension provides bad credentials, then the listener will be called again. For this reason, take care not to enter an infinite loop by repeatedly providing bad credentials.
+> **Note:** In Chrome, as of Manifest V3, the "webRequestBlocking" permission is no longer available for most extensions (the exception being policy-installed extensions). However, as of Chrome 108, using the "webRequest" and "webRequestAuthProvider" permissions enables you to supply credentials asynchronously.


This information needs to go in the browser compatibility data. Here's an example of how to do it. Let me know if you need help.

Given the complex requirements and non-obvious usage, I'm in favor of including a mention of how/when these can be used. See my larger review comment. The version can be dropped from the text (and kept in the BCD), as 108 is multiple releases ago and not relevant to most. Just "MV2" vs "MV3" should be clear enough.

Rob--W

Much more is needed before this article is Chrome-compatible. This is mainly due to incompatibilities. Below I am only mentioning Firefox and Chrome because Safari doesn't support the webRequest API at all.

On the permission requirement:

Firefox: webRequest + webRequestBlocking. webRequestAuthProvider is not supported, but we have a bug tracking that at https://bugzilla.mozilla.org/show_bug.cgi?id=1820569
Chrome: webRequest + webRequestBlocking (MV2 only) OR webRequest + webRequestAuthProvider (MV2 and MV3)

On registering the event, to handle the event synchronously - this is the same across browsers (unfortunately, only viable for the simplest of extensions).

Firefox and Chrome: extraInfoSpec array must include "blocking", and the event handler function must return the BlockingResponse directly. Note that it does not count if async function is used instead of a function, because that automatically turns the function into a function that returns a Promise. That works in Firefox (see below), but not in Chrome.

Now the more difficult part happens when the event should be handled asynchronously. Support is inconsistent and Chrome's documentation is very lacking there (seems that there is an open bug at crbug.com/693286 to improve that?).

Firefox: extraInfoSpec array must include "blocking", and the event handler function can return a Promise that resolves to a BlockingResponse object. Note that the usage is basically the same as the synchronous event handler case.
Chrome: extraInfoSpec array must include "asyncBlocking" (without "blocking"!). The event handler function is passed a second parameter (called asyncCallback) that should be invoked with the BlockingResponse result.

EDIT: FYI I filed w3c/webextensions#490 to seek alignment between Firefox and Chrome.

Rob--W · 2023-11-14T14:12:18Z

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md


 See [Examples](#examples).

 If you use `"blocking"` you must have the ["webRequestBlocking" API permission](/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions#api_permissions) in your `manifest.json`.

-If your extension provides bad credentials, then the listener will be called again. For this reason, take care not to enter an infinite loop by repeatedly providing bad credentials.
+> **Note:** In Chrome, as of Manifest V3, the "webRequestBlocking" permission is no longer available for most extensions (the exception being policy-installed extensions). However, as of Chrome 108, using the "webRequest" and "webRequestAuthProvider" permissions enables you to supply credentials asynchronously.


Given the complex requirements and non-obvious usage, I'm in favor of including a mention of how/when these can be used. See my larger review comment. The version can be dropped from the text (and kept in the BCD), as 108 is multiple releases ago and not relevant to most. Just "MV2" vs "MV3" should be clear enough.

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md

Co-authored-by: Joe Medley <[email protected]>

Rob--W

Note: the thread on the urlclassier was resolved. One of my remarks was that it should be consistent across all webRequest events. Are you going to create a separate PR for that?

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md

Co-authored-by: Rob Wu <[email protected]>

rebloor · 2023-11-30T02:51:05Z

Note: the thread on the urlclassier was resolved. One of my remarks was that it should be consistent across all webRequest events. Are you going to create a separate PR for that?

@Rob--W as it's tangential I've created Clarify fingerprinting and fingerprinting_content #30644 – I have an unwound the grammatical improvements, I'll apply those to the other events when I address the issue.

Rob--W

r+ with 2 minor changes.

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md

Co-authored-by: Rob Wu <[email protected]>

github-actions · 2023-12-11T21:52:44Z

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md


    - in addListener, pass `"blocking"` in the `extraInfoSpec` parameter
-    - in the listener, return a `Promise` that is resolved with an object containing an `authCredentials` property, set to the credentials to supply
+    - in the listener, return a `Promise` that resolves with an object containing an `authCredentials` property, set to the credentials to supply
+


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

* Details for the webRequestAuthProvider permission * Feedback update * Review feedback Co-authored-by: Joe Medley <[email protected]> * Apply suggestions from review Co-authored-by: Joe Medley <[email protected]> * Feedback from review Co-authored-by: Rob Wu <[email protected]> * Apply suggestions from review Co-authored-by: Rob Wu <[email protected]> * Adjust formatting --------- Co-authored-by: Joe Medley <[email protected]> Co-authored-by: Rob Wu <[email protected]>

Details for the webRequestAuthProvider permission

09c59d6

rebloor added the Content:WebExt WebExtensions docs label Nov 10, 2023

rebloor self-assigned this Nov 10, 2023

rebloor requested a review from a team as a code owner November 10, 2023 17:39

rebloor requested review from jpmedley and removed request for a team November 10, 2023 17:39

rebloor mentioned this pull request Nov 11, 2023

Support details for webRequestAuthProvider permission mdn/browser-compat-data#21216

Merged

jpmedley requested changes Nov 13, 2023

View reviewed changes

Rob--W requested changes Nov 14, 2023

View reviewed changes

Rob--W mentioned this pull request Nov 14, 2023

Support Promise as return value from webRequest.onAuthRequired w3c/webextensions#490

Open

Feedback update

caa8778

rebloor requested review from Rob--W and jpmedley November 15, 2023 07:09

Merge branch 'main' into webRequestAuthProvider-permission

aa0c491

jpmedley requested changes Nov 15, 2023

View reviewed changes

rebloor and others added 2 commits November 16, 2023 14:33

Review feedback

1143f6d

Co-authored-by: Joe Medley <[email protected]>

Apply suggestions from review

5130c00

Co-authored-by: Joe Medley <[email protected]>

rebloor mentioned this pull request Nov 21, 2023

Update webRequest.onAuthRequired extraInfoSpec with Chrome webRequestAuthProvider #21586

Closed

rebloor requested a review from jpmedley November 27, 2023 01:39

jpmedley approved these changes Nov 29, 2023

View reviewed changes

Merge branch 'main' into webRequestAuthProvider-permission

f4df274

Rob--W reviewed Nov 30, 2023

View reviewed changes

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md Outdated Show resolved Hide resolved

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md Outdated Show resolved Hide resolved

Feedback from review

34cd232

Co-authored-by: Rob Wu <[email protected]>

rebloor requested a review from Rob--W November 30, 2023 02:51

Rob--W approved these changes Dec 11, 2023

View reviewed changes

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md Outdated Show resolved Hide resolved

files/en-us/mozilla/add-ons/webextensions/api/webrequest/onauthrequired/index.md Show resolved Hide resolved

Apply suggestions from review

4d60d5f

Co-authored-by: Rob Wu <[email protected]>

github-actions bot reviewed Dec 11, 2023

View reviewed changes

Adjust formatting

7f3a215

Merge branch 'main' into webRequestAuthProvider-permission

a62e1e0

rebloor merged commit 789f5df into mdn:main Dec 11, 2023
7 checks passed

rebloor deleted the webRequestAuthProvider-permission branch December 11, 2023 22:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Details for the webRequestAuthProvider permission #30188

Details for the webRequestAuthProvider permission #30188

rebloor commented Nov 10, 2023 •

edited

Loading

github-actions bot commented Nov 10, 2023 •

edited

Loading

jpmedley left a comment

jpmedley Nov 13, 2023

Rob--W Nov 14, 2023

Rob--W left a comment •

edited

Loading

Rob--W Nov 14, 2023

Rob--W left a comment

rebloor commented Nov 30, 2023

Rob--W left a comment

github-actions bot Dec 11, 2023

Details for the webRequestAuthProvider permission #30188

Details for the webRequestAuthProvider permission #30188

Conversation

rebloor commented Nov 10, 2023 • edited Loading

Description

Motivation

Additional details

Related issues and pull requests

github-actions bot commented Nov 10, 2023 • edited Loading

jpmedley left a comment

Choose a reason for hiding this comment

jpmedley Nov 13, 2023

Choose a reason for hiding this comment

Rob--W Nov 14, 2023

Choose a reason for hiding this comment

Rob--W left a comment • edited Loading

Choose a reason for hiding this comment

Rob--W Nov 14, 2023

Choose a reason for hiding this comment

Rob--W left a comment

Choose a reason for hiding this comment

rebloor commented Nov 30, 2023

Rob--W left a comment

Choose a reason for hiding this comment

github-actions bot Dec 11, 2023

Choose a reason for hiding this comment

rebloor commented Nov 10, 2023 •

edited

Loading

github-actions bot commented Nov 10, 2023 •

edited

Loading

Rob--W left a comment •

edited

Loading