Inconsistency: Host permissions in Manifest V3

[muzuiget]

I wrote some testing code about host permissions for current Chrome and Edge stable version:

• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 Edg/106.0.1370.42

I found some inconsistency, it may also mislead users to know the actual host permissions are required/granted by the extension.

1. Defined in content_scripts

This imply required host permissions:

{
    "manifest_version": 3,
    "name": "mv3",
    "version": "0.1.0",
    "content_scripts": [
        {
            "matches": [
                "https://www.youtube.com/*"
            ],
            "js": [
                "youtube.js"
            ]
        }
    ]
}

Chrome:

Edge:

Edge's "on all sites" makes it seem like extensions require any host permissions.

2. Defined in host_permissions

Runing chrome.scripting.registerContentScripts() in backgroud.js

{
    "manifest_version": 3,
    "name": "mv3",
    "version": "0.1.0",
    "permissions": [
        "scripting"
    ],
    "host_permissions": [
        "https://www.youtube.com/"
    ],
    "background": {
        "service_worker": "background.js",
        "type": "module"
    }
}

Chrome:

Edge:

The same as "Defined in content_scripts"

Defined in optional_host_permissions

After first-install, use chrome.permissions.request() to grant the permission.

{
    "manifest_version": 3,
    "name": "mv3",
    "version": "0.1.0",
    "permissions": [
        "scripting"
    ],
    "optional_host_permissions": [
        "https://www.youtube.com/"
    ],
    "options_page": "options.html",
    "background": {
        "service_worker": "background.js",
        "type": "module"
    }
}

Chrome on first-install:

Chrome after grant:

Edge on first-install:

Edge after grant:

• Chrome doesn't listing the host items on first-install.
• Edge doesn't tell users the extension really granted host.

---

Even Edge is chromium-base browser, it has difference behavior than Chrome.

Currently I prefer Safari behavior:

• treat all host permissions are user optional.
• listing all host items in the extension manage page to let users one-click to allow/disallow.

So for users, host_permissions just the same as optional_host_permissions, they are optional at runtime.

But developers still can use host_permissions to add some extra behaviors:

• The hosts are force to be granted on first-install from Chrome Store, this make the extension works out-of-box.
• Show a required-icon on the listing host items, to warn users: "if you disallow it, you maybe break the extension".

[mukul-p]

Feel free to fire Browser specific issue (or cross reference from here).
This is for Microsoft Edge - https://github.com/microsoft/MicrosoftEdge-Extensions/