From MozillaWiki
Jump to: navigation, search

Developing with WebExtensions

These FAQs cover development with WebExtensions and was started in July 2016.

These FAQs are in draft status.

Is it multiprocess Firefox compatible?

Yes, all APIs work with multi process Firefox and are marked as compatible by default.

Are they compatible with Chrome and Opera?

Mostly. We strive for compatibility to make developers lives easier and are participating in a W3C community group to work on a standard.

However Chrome, Firefox and Opera are different browsers and not all the APIs in one browser is even possible in another browser. For that reason there are incompatibilities and likely always be, but hopefully we can minimize those.

Will WebExtensions be a stable API?

Yes. We are currently planning a way to have an experimental track. A policy for deprecating or making backwards incompatible changes has not been decided.

Can I add APIs to WebExtensions?

Absolutely and we encourage you to do so. If you are a legacy add-on developer and need an API, you might find adding in API not too difficult.

  • Can I accomplish this another way that doesn't need an API? WebExtensions have full access to the window object meaning that all existing Web APIs are available to the developer.
  • Are there security or privacy concerns about such an API (the security team at Mozilla can help review this too)?
  • Is this API going to be valuable to not just me, but also other add-ons developers? Every API we add to Firefox increases the engineering burden for the Mozilla community and removing APIs once they have landed is hard. Just like we'd think about adding in a new Web API to Firefox, we should take the time to think about exactly what we need.

If you are unsure about the above, please just file a bug in Bugzilla under Toolkit > WebExtensions and add the whiteboard tag [design-decision-needed]. This will allow it to be reviewed by the module owners and make sure it makes sense before you spend too much time on the API.

Will I be able to do everything I can in a legacy technology?

No. In the legacy technologies (extensions, bootstrapped extensions, SDK extensions) developers had access to almost everything in Firefox. This causes many problems from security and privacy concerns to technology changes throughout the Firefox stack.

Will I have access to about:config or the preferences?

Very unlikely. Access to the preferences in the past has caused us problems. Multiple add-ons try to change them and conflict. There is no security limitations so low risk preferences and high risk preferences are mixed together. Sadly these have been exploited by add-on authors in the past.

The preferences though are generally a low level implementation detail. They are altered and changed frequently, with new preferences being added or just ignored quite frequently. Instead we'd rather WebExtensions focus on higher level APIs that implement specific tasks, those APIs might alter preferences, but it would be to the WebExtension API to manage that, not the WebExtension developer.

Will I have access to about pages, with chrome_url_overrides?

Hopefully, but there's a few concerns here. WebExtensions exist inside a sandbox within Firefox to limit the amount of interaction with Firefox. The about pages within Firefox run with chrome privileges. We need to be careful about allowing access to those because it could be a possible escalation point for a WebExtension and a way to break out of the sandbox.

If that could be solved, then it seems possible for access to these APIs to happen.

WebExtensions Decision

Some of these are relevant, but come from an FAQ around the decision to implement WebExtensions in August of 2015. They may not still be relevant.

How are you involving the community in the development of WebExtensions?

We are actively reaching out to developers to find out what APIs they need to migrate to WebExtensions. This helps us figure out which ones will help the greatest number of developers, and prioritize them accordingly. The goal is to first reach Chrome parity, then go beyond. Anyone can request a new API by filing a bug.

To make the decision process as transparent as possible, we hold a public triage of these bugs every other week. Each one is labeled "design needed", "approved", or "rejected". If approved, additional information on how to write the API is included, and an advisor is assigned. Anyone who is interested in working on it can take it.

Why are these big changes needed?

We believe that moving Firefox away from XUL and XPCOM is a long-term strategic necessity. These technologies are 15 years old and no other browser uses them. It doesn't make sense for us to continue to invest in them, but at the same time our performance and security depends on them.

However, we can't even begin to move Firefox off of these technologies until we know how to evolve add-ons as well. We have announced WebExtensions and the deprecation as early as possible so that we can get feedback from the community on how to make the transition. We know that WebExtensions will need to be improved. We also know that XUL will continue to live in some form for a while.

It sounds like you're copying Google...

The Chrome extension API was designed to work well with process separation and we are taking inspiration from it and copying functionality where it makes sense. However, there will be differences, and the goal of WebExtensions is not to copy Chrome or allow Chrome extensions to run unmodified in Firefox, but to simplify cross-browser development by providing commonly-supported methods and interfaces. We won't implement all of Chrome's APIs, and Chrome is unlikely to implement some of the APIs we add. Imagine the APIs as a Venn diagram. In the middle are cross-browser APIs for content scripts, tabs, and windows. In the Firefox side are APIs for toolbars and other UI elements. On the Chrome side are APIs for Google's cloud services.

How will WebExtensions be cross-browser if you're extending Google's API?

Unlike the web platform, we don't expect every browser to implement every aspect of WebExtensions in the same way. But, even without perfect compatibility between browsers, a common API still has many advantages for extension developers. If developers stay within the common API, their extensions should work with minimal (or no!) modifications across browsers. Even if developers choose to use browser-specific APIs, their extensions may be usable on other browsers through feature detection and fallbacks. As an example, an extension using a toolbar API might be able to fall back to a browser action API on other browsers.

What do you mean by "Extending the capabilities of Firefox to interact with web content" in your vision statement?

It means helping people use the Web, like making it easier to browse, manage browsing, and use websites/web apps/content. Our focus with the WebExtensions API is about extending these capabilities rather than making Firefox an application platform.

Why WebExtensions and not Jetpack?

There are a number of reasons we chose to focus development on the WebExtension API. First, there are more Chrome extensions than Jetpack add-ons and more developers who will be familiar with developing WebExtensions. WebExtensions has built-in support for content blocking, which is used by many ad-blocking and anti-tracking extensions that are popular; Jetpack lacks such APIs. Jetpack won't solve the problem that add-on developers must maintain a different codebase for each browser. Basing our initial implementation of WebExtensions off of Chrome's API means that developers who stick to the common APIs will be able to work off of a common codebase, and port extensions more simply between browsers.

In Jetpack's favor, it has a powerful module system similar to the one in node.js. However, given that JavaScript will soon have built-in support for modules, this won't be an advantage for long.

Which add-ons will stop working when XUL/XPCOM is deprecated?

Many add-ons will need to be updated, and we anticipate that some will break with the transition to the new APIs. There is a risk that some add-ons may not transition if they are not maintained or have maintainers who lack the time to port their add-on.

We don't want to limit what add-ons can do in Firefox. We will work with every developer who is interested to make their add-on work in Firefox, and work to provide the functionality required in as many cases as possible. This process is designed to allow developers to extend Firefox in ways that are less brittle than the current XUL/XPCOM system, and to allow Firefox itself to transition away from XUL/XPCOM.

I'm writing a new extension today. What API should I use?

As of July 2016, we are strongly recommending WebExtensions for add-on development.

That's a complex decision. If you already have a Chrome extension, it's probably best to wait until WebExtensions are ready for general purpose use. We expect that to take a few more months. You can consult the WebExtensions wiki to see whether the APIs you're using are supported or whether they're likely to be supported in the future.

If you're planning to write a new, Firefox-specific extension, the add-on SDK (Jetpack) may be your best option until WebExtensions matures. Jetpack is well supported in older versions of Firefox and is well-documented. However, make sure to read "Multiprocess Firefox and the SDK" to ensure your add-on is compatible with Electrolysis.

Won't this limit experimentation?

If WebExtensions were ultimately limited to the Chrome model, it would. But we're actually designing a system providing extension authors with the flexibility to implement innovative features that the WebExtension API doesn't currently allow. Some discussion has already begun. The intent is for add-on authors to experiment through this mechanism, with the knowledge that there are no guarantees of compatibility between Firefox releases, and use that to inform future additions to the stable WebExtension API.

Why deprecate XUL now? Firefox is still using it internally.

Yes, Firefox is using XUL internally right now. But, Firefox is actively planning for the removal of XUL internally. That will translate into death by 100s of paper cuts (i.e. breakage with every release) for addons that depend on Firefox's usage of XUL as it is progressively removed from the product.

Why keep the .xpi packaging format?

We're using JAR signing for WebExtensions, and Chrome uses a different system. Since signing is necessarily browser-specific, integrating the two would be difficult, and maintaining the current packaging extension for Firefox makes sense. The only part of the XPI file format that WebExtensions uses is the filename suffix, and there may be some changes to the final extension we use as we seek (and get) more feedback.

Are malicious addons really a problem?

Yes. Please read "The Case for Extension Signing".