Skip to content

Issue-34349 Additional advice on use of the "incognito" key #44036

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rebloor wants to merge 1 commit into
base: main
Choose a base branch
from
+5 −0
Open

Issue-34349 Additional advice on use of the "incognito" key #44036

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions files/en-us/mozilla/add-ons/webextensions/manifest.json/incognito/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,11 @@ Use the `incognito` key to control how the extension works with private browsing
> [!NOTE]
> By default, extensions do not run in private browsing windows. Whether an extension can access private browsing windows is under user control. For details, see [Extensions in Private Browsing](https://support.mozilla.org/en-US/kb/extensions-private-browsing). Your extension can check whether it can access private browsing windows using {{WebExtAPIRef("extension.isAllowedIncognitoAccess")}}.

> [!NOTE]
> If your extension needs to maintain the privacy expectations of Private browsing mode, don't include the incognito key.
>
> This recommendation is made to avoid leaking state information from private browsing to non-private browsing. A common mistake in extensions is sending data from a content script (potentially in a tab in a private browsing window) to an external server through a network request from the background page. Because the background script shares the same cookies as the main browsing session, this could result in activity leaking from the private browsing window to the non-private browsing session. A way to avoid this is to use the `credentials: "omit"` flag in {{DOMxRef("fetch")}} (along with `cache: "no-cache"`), or the `mozAnon: true` option in {{DOMxRef("XMLHttpRequest")}}.

This is a string that can take any of these values:

- "spanning" (the default): the extension sees events from private and non-private windows and tabs. Windows and tabs gets an `incognito` property in the [`Window`](/en-US/docs/Mozilla/Add-ons/WebExtensions/API/windows/Window) or [`Tab`](/en-US/docs/Mozilla/Add-ons/WebExtensions/API/tabs/Tab) that represents them. This property indicates whether or not the object is private:
Expand Down