Why does Floccus require broad permissions in Firefox?

[patrick-motard]

I got a notification in Firefox today that this app has updated and has new permissions I need to approve. "Access your data for all websites" is very vague. What data? Why does Floccus need it?

[marcelklehr]

Hi @patrick-motard

This is not new, but the move to manifest v3 triggers this renewed approval popup.

Quoting from floccus.org:

Unlimited web access is necessary for accessing your self-hosted server. This cannot be limited, because everybody's server has a different URL. Unfortunately, the way webextensions work currently, floccus also gets access to all the data the browser has collected on those websites. However, floccus makes no use of that data and doesn't in any way collect information about you.

[patrick-motard]

Unlimited web access is necessary for accessing your self-hosted server

Why is this true? Why would an extension making API calls to a configurable domain require granting the extension access to ALL data the browser has collected about that domain?

[marcelklehr]

I don't know. This is how chrome was designed and Mozilla took that over: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/host_permissions