0

I have a Chrome extension that watches for an extra query parameter in a url on certain sites. I'm adding functionality to a new site and the issue I'm running into is that the site redirects to a different url and strips out my custom query before my content script can load.

It looks like I can get around this by using the webNavigation API in my background script and adding a listener for chrome.webNavigation.onCommitted. The problem is that by adding webNavigation permissions into my manifest, I'm now asking for permission to "Read your browsing history." I've put a lot of time into trying to limit the scope of my extension permissions to certain sites and I really don't want to ask the user for carte blanche permission like this.

I've found two other threads on SO about this issue, but in one, the user found a workaround that I don't think will work in my case (although if someone has a suggested workaround, I'm all ears), and the other suggests that by adding a filter to the listener declaration, it will limit the permissions request. That answer was not accepted as correct and, indeed, I'm not seeing any permissions difference whether or not I have a filter.

Is it simply not possible to achieve what I'd like to do and also limit the scope of the permissions warning? Or am I missing something? Thanks.

My webNavigation listener declaration:

chrome.webNavigation.onCommitted.addListener(function(e) {
    //Can dig out my query parameter from e
    console.log(e);
},{
    url: [{hostContains: "[NAME OF HOST]"}]
});
typingm
  • 59
  • 6
  • Use [optional permissions](https://developer.chrome.com/extensions/permissions). – wOxxOm Nov 12 '18 at 04:38
  • 1
    Thanks. I don't think this necessarily solves the problem. It just kicks the can down the road for when you're asking for key-to-the-castle permissions. Figured out a workaround, see below, that happened to work in my situation but it won't be universally applicable. – typingm Nov 12 '18 at 06:51
  • I didn't have the webRequest permission before, but in adding it, Chrome requested no additional permissions. Before and after adding webRequest, the permission Chrome asked for was to "Read and change your data on a number of websites." And then it listed several websites, which I had laid out in a content-script>matches array in my manifest.json. I need to run a contentscript on those sites, so that permissions scope makes sense. – typingm Nov 12 '18 at 08:16
  • I figured out the webRequest workaround before I saw your solution, so I haven't played with optional permissions, but looking at the documentation, it seems like optional permissions are still asking for too much, even if you limit their scope. Documentation says that requesting optional permissions of `permissions: ['tabs'], origins: ['http://www.google.com/']` will ask the user to "Access your data on www.google.com" and "Access your tabs and browsing activity." Even if you're limiting the scope, it still seems to be asking for everything. – typingm Nov 12 '18 at 08:21
  • Sorry for the confusion. I didn't know webRequest doesn't add its own permission notice. Could you add this bit of info to your answer? I think it's crucial. I mean rephrase it so that it's more clear. – wOxxOm Nov 12 '18 at 08:22
  • Thanks. Hopefully explained it better in my answer. – typingm Nov 12 '18 at 19:56

1 Answers1

2

I was able to figure out a workaround for my situation. I don't think this will work for everyone, but using the webRequest API allowed me to intercept the page load request before the redirect and store my query string for later. The webRequest API also didn't ask for any permissions beyond what I was already asking for via a content-script>matches array in my manifest.json file, which causes Chrome to ask for permission to "Read and change your data on a number of websites" and then lists those websites.

chrome.webRequest.onBeforeRequest.addListener(
    function(details) {

        //details.url contains my query string 
        var url = details.url;
        return;
    }, {
        urls: ['*://*.mysite.com/*'],
        types: ['main_frame'] //Filters out all the js,css,ajax,etc requests
    }
);
typingm
  • 59
  • 6