search

persepolisdm / Persepolis-WebExtension

WebExtension integration for Persepolis download manager
http://persepolisdm.github.io
GNU General Public License v3.0
73 stars 9 forks source link

Doesn't work with First-Party Isolation enabled in Firefox #36

Open yaxunema95 opened 3 years ago

yaxunema95 commented 3 years ago

In Firefox (using 78.0.2 on Arch Linux), with First-Party Isolation (FPI) enabled (privacy.firstparty.isolate = true in about:config), the extension will interrupt downloads, but won't open them in Persepolis, so downloads will never start.

FPI restricts access to cookies, site storage, etc. by domain, though one of the permissions of the Persepolis extension is "Access your data for all websites". I'm not sure what's supposed to take priority here, but it looks like FPI--the extension is looking for cookies (required for some downloads) and Firefox is blocking access to them.

JafarAkhondali commented 3 years ago

Duplicate https://github.com/persepolisdm/Persepolis-WebExtension/issues/20. Sending URLs to Persepolis without cookies will result in in ambiguous behavior. It would a better idea if FF could allow exceptions in their list.

yaxunema95 commented 3 years ago

Duplicate #20.

Wow, how'd I miss that?

It would a better idea if FF could allow exceptions in their list.

Agreed. Not sure what the best suggestion to FF devs would be. FPI is a huge win for privacy, and it makes sense that web extensions are considered third parties. Download manager integrators are an odd special case.

Forgive me for spitballing here, but I could suggest the following on FF's Bugzilla as possible options:

  1. Have the extension permission "Access your data for all websites" override FPI (i.e. leave it to the user to pay attention to permissions).
  2. Add a privacy.firstparty.isolate.include_extensions preference to toggle the above option.
  3. Add some sort of additional per-extension trust option, similar to "Allow in private windows".

The ultimate solution would be per-domain/extension exceptions/overrides/profiles for all preferences, but we might be a long way from that.