Thumbnail refreshing breaks with no user feedback if "Access data for all websites" permission isn't granted

[josh-berry]

Summary

When refreshing a thumbnail, you may want to do an explicit permissions check and tell the user they need to grant permission to "Access data for all websites". Firefox's new update / permissions flow for add-ons gave me no indication that I needed to grant new permissions for thumbnail refresh to work, so I had no idea why thumbnails were suddenly failing to refresh without digging into the dev console etc.

Steps I Followed

1. Auto-update to the latest version of YASD
2. Open YASD in a new-tab page
3. Right-click and choose "Refresh All Thumbnails..."
4. Notice all the thumbnails disappear and nothing else happens
5. Get very confused because all my thumbnails disappeared
6. Investigate what's happening in Firefox's devtools as explained below
7. Notice the little blue dot under the "add-ons" icon in my toolbar
8. Click the blue dot and notice that YASD needs more permissions
9. Grant those permissions
10. Notice everything works now

Details

• yet another speed dial version: 3.7.6
• Firefox version: Mac Nightly - 140.0a1 (2025-04-29) (aarch64)

In the devtools console for the background page, I see that all requests seem to be failing because of CORS. For example, trying to fetch a thumbnail for ycombinator seems to fail with:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://news.ycombinator.com/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 405.

Here's an example failed request (sorry this is a screenshot; copy/paste wasn't cooperating):

After a little digging, I determined this was because the addon didn't have the "Access data for all websites" permission it requested after the latest update, as explained above. Everything worked fine after that.

(Also, from one add-on developer to another: Thanks for making YASD, and thanks for making it open source. I've found it super useful and I'm glad it exists. :) )

[conceptualspace]

thanks for this, good idea for the explicit permissions check.

im curious about the update -- v3 doesnt have any novel permissions (all hosts was always required to be able to fetch images) but in manifest v3 the permission moved from the "permissions" key to the "host_permissions" key. if firefox isnt granting that by default thats definitely an issue, but i didnt notice this in testing -- appreciate any insights you can share here!

[josh-berry]

If you just moved to manifest v3 recently, you probably got bitten by this: https://blog.mozilla.org/addons/2022/11/17/unified-extensions-button-and-how-to-handle-permissions-in-manifest-v3/

In particular:

[...] MV3 treats host permissions (listed in the extension manifest) as opt-in.

The blog post I linked does a pretty nice job of explaining how to check for and request permissions, though.

I'm not sure why this didn't show up in your testing; maybe something is different in Firefox about how unpacked MV3 extensions are loaded? But I'm just guessing. (I myself have not moved to MV3 because having the background page spontaneously unload itself makes for significantly higher complexity, and I don't support Chrome anyway.)

Anyway, hope this helps!

[conceptualspace]

thank you for that, yeah MV3 has been a royal PITA and i really hoped chrome would back off but of course they steamrolled it through and now trying to support both browsers went from relatively simple to relatively not...

btw i just checked out tab stash -- that is such a good idea and extremely useful!

[Blackhazard2012]

Hi, does that mean you no longer support Chrome? Or will soon stop supporting it?

[conceptualspace]

@Blackhazard2012 chrome is definitely still supported!

google recently required a pretty big refactor (#122) which took some time to get working on firefox, but is done now 😄

[Blackhazard2012]

@conceptualspace

Okay, I'm glad to hear that :D. Currently, I'm having the same problem with Chrome version 3.7.6 as described in this thread (thumbnails aren't being created correctly). I'm looking forward to a future update, and thank you for developing this super tool.

[conceptualspace]

@Blackhazard2012 from the chrome://extensions page click "details" for yasd and confirm you have granted all the necessary permissions: "site access" should be "all sites", otherwise it won't be able to fetch thumbnails automatically. if that isnt the cause, please let me know if any errors show on the extension page. can you manually add images?

[Blackhazard2012]

Hi, adding images manually works (it's the solution I'm currently using). The permissions are, of course, set to "all websites," and errors aren't displayed in the console either. When I refresh all views or even just one page, only the icon is displayed instead of the screenshot of the website itself.

[conceptualspace]

got it, thanks -- yes i temporarily removed the screenshot functionality with the manifest v3 refactor for chrome, but it will be restored in a future update. for now if you want screenshots they are still recorded when you first create the speed dial if you do it via bookmarking (ie, open the site, then bookmark it to the speed dial folder with the favorites button or context menu)

[moriel5]

Hmm... That certainly explains why I was no longer able to get screenshots of pages on newer installations (preparing new hard drives) of Firefox and Floorp, glad to see that the feature is planned to name a return.