CODEWITHSUNDEEP
google-chrome-extensionmanifest.json
lsdpower
lsdpower

Reputation: 23

What is "content_capabilities" field in chrome extension's manifest file?

I've searched Chrome Extension manifest document docs(https://developer.chrome.com/extensions/manifest), there's a "content_capabilities", but no link for that.

I infer it giving "permissions" to the "matches" as below.

  "content_capabilities": {
      "matches": [ "https://docs.google.com/*", "https://drive.google.com/*" ],
      "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ]
  },

but whenever I try to use this format in my local sample extension, I get this error.

'content_capabilities' is not allowed for specified extension ID

Is this format able to use in general users?

Upvotes: 2

Views: 340

Answers (1)

woxxom
woxxom

Reputation: 73556

Indeed, it grants the specified permissions to web sites matching the specified URL patterns. Here's why it was implemented:

Some hosted apps are used primarily to grant websites clipboardRead and clipboardWrite permissions, e.g. the Drive default hosted app. As part of the platform's move away from hosted apps, extensions should have the ability to grant these permissions to verified websites. These permission grants should be explicitly specified in the extension's manifest and displayed to users on extension install.

It's limited to a list of a few verified extensions (Google Drive and a few unnamed ones that could be internal Google extensions) but the restriction is applied only in the stable Chrome so you can use it in beta/dev/Canary channels [source].

In the old times (or even today in case you target the old browsers), if a web site like a text editor wanted to have the ability to access clipboard or an unlimited storage, the users had to install a separate hosted app for the site with the only purpose of granting these permissions. Hosted apps were deprecated long time ago (still supported though) so this content_capabilities key was exposed to extensions.

This is an obsolete thing now that the web platform supports the asynchronous Clipboard API and Persistent Storage API.

Upvotes: 1

Related Questions