javascript - "Broad host permissions" Webstore warning despite only one host in permissions - Stack Overflow

admin管理员组

文章数量:1292869

I'm trying to publish a chrome extension but, when I try, this message appears:

Because of the following issue, your extension may require an in-depth review:

• Broad host permissions

Instead of requesting broad host permissions, consider using the activeTab permission, or specify the sites that your extension needs access to. Both options are more secure than allowing full access to an indeterminate number of sites, and they may help minimize review times.

The activeTab permission allows access to a tab in response to an explicit user gesture.

{
  ...
  "permissions": ["activeTab"]
}

If your extension only needs to run on certain sites, simply specify those sites in the extension manifest:

{
  ...
  "permissions": ["/*"]
}

My manifest has those permissions:

{
 "manifest_version":2,
 "name": "Online Console",
 "version":"1.0",

 "description": "Simulador de consola de Online",
 "browser_action":{
  "default_icon": "icon24.png",
  "default_popup": "primero.html"
 },
 "permissions": [ "activeTab", "" ], 

 "content_scripts": [{
    "js": [ "jquery.min.js" ],
    "matches": [ "http://*/*", "https://*/*" ]
 }]
}

Why am I getting this warning and how to solve it?

I'm trying to publish a chrome extension but, when I try, this message appears:

Because of the following issue, your extension may require an in-depth review:

• Broad host permissions

Instead of requesting broad host permissions, consider using the activeTab permission, or specify the sites that your extension needs access to. Both options are more secure than allowing full access to an indeterminate number of sites, and they may help minimize review times.

The activeTab permission allows access to a tab in response to an explicit user gesture.

{
  ...
  "permissions": ["activeTab"]
}

If your extension only needs to run on certain sites, simply specify those sites in the extension manifest:

{
  ...
  "permissions": ["https://example./*"]
}

My manifest has those permissions:

{
 "manifest_version":2,
 "name": "Online Console",
 "version":"1.0",

 "description": "Simulador de consola de Online",
 "browser_action":{
  "default_icon": "icon24.png",
  "default_popup": "primero.html"
 },
 "permissions": [ "activeTab", "https://google." ], 

 "content_scripts": [{
    "js": [ "jquery.min.js" ],
    "matches": [ "http://*/*", "https://*/*" ]
 }]
}

Why am I getting this warning and how to solve it?

• javascript
• html
• google-chrome-extension
• permissions
• manifest

Share Improve this question Follow edited Oct 22, 2018 at 13:33 Xan 77.6k1818 gold badges197197 silver badges217217 bronze badges asked Oct 22, 2018 at 12:32 Marcos Alejandro PérezMarcos Alejandro Pérez 18122 silver badges1616 bronze badges

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 10

Having a host match in content scripts implicitly grants you host permissions.

So, your effective host permissions are "*://*", and that's what you need to fix.

If you have activeTab permissions to activate your extension on user gesture, and you need jQuery, just inject that first programmatically before your code.

Don't just indiscriminately inject jQuery into every page "just in case" before it's needed. So, your content_scripts section needs to go pletely (or be restricted to "https://google." to match explicit permissions)

本文标签：