Intent to remove about:permissions

Dao Gottwald dao at
Sat Nov 7 11:30:58 UTC 2015

about:permissions was implemented in 2011 but never intentionally exposed to end users, i.e. we don't link to it from about:preferences#content or from the control center a.k.a. identity panel or anything. The reason for that is that we're not happy with the UI, and there's no clear path forward; in a sense it's already dead code. Two years ago, bug 933917 was filed on removing about:permissions. We should finally do this.

The [hosts -> permissions] mapping used by about:permissions is fundamentally flawed. It doesn't work well with different permissions that may apply to either a full host or eTLD + 1, or permissions that differentiate between http and https. It's hard to communicate these nuances in this kind of UI where users are supposed to pick a "site" (whatever that means) first. There's a good chance users would get stuck at that first step.

I do think we should have a place for advanced permission management besides the control center (where users need to visit a site so they can change its permissions). Host whitelists and blacklists for various permissions are currently scattered across about:preferences#content, about:preferences#security, about:preferences#advanced and probably other places I don't even remember. Obviously this is far from ideal. However, I think any attempt to centralize these UIs ought to keep their [permissions -> list of hosts] mapping. So about:permissions with its [hosts -> permissions] approach isn't even a good starting point for future work.

You may wonder, since about:permissions is quite self-contained, why not just keep it around for the time being for those who few who accidentially discovered it? More than two years ago I introduced SitePermissions.jsm in bug 885366. It has proven useful as the backend for the control center and for Page Info > Permissions, making it trivial to add new permissions there. Unfortunately, it can't be used easily as a backend for about:permissions. This makes about:permissions and ongoing tax that a number of developers have paid over the years. As an example, these changes were needed to add Push notifications to the control center and Page Info:

... whereas these changes were needed to add them to about:permissions:

So from this perspective as well, we really should have gotten rid of about:permissions a long time ago. We've been wasting way too many resources on it.

Thoughts? Have I missed something?


More information about the firefox-dev mailing list