fix(firefox): claims fail because cookies are never attached · plus silent-failure guard for ungranted host permissions - #4
Open
justerlex wants to merge 1 commit into
Conversation
…ssion Firefox never attaches cookies to cross-origin fetches from extension contexts (default credentials mode is same-origin), while Chrome attaches them implicitly for host-permitted requests, so every claim on Firefox reached the API anonymously and returned retcode -100. All HoYoLAB fetches now pass credentials: 'include' (a no-op on Chrome). Firefox also treats MV3 host_permissions as optional and ships them OFF by default; without the grant the fetches are CORS-blocked and the extension fails silently. The popup now checks the grant on mount and shows a warning banner with a Grant button (never visible on Chrome, where install grants host permissions). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
On Firefox (tested on Zen, a Firefox fork), every claim fails with "Log in to Hoyolab first" (retcode
-100) even while the user is demonstrably logged into hoyolab.com. Relogging any number of times does not help. The README lists Firefox/Zen as supported, so this affects every Firefox user.Two root causes, both Firefox-only
1 ·
fetch()never attaches cookies. All HoYoLAB calls inclaimable.tsuse the default credentials mode (same-origin). Chrome attaches cookies implicitly to host-permitted extension requests, which is why the Chrome build works. Firefox follows the fetch spec strictly: a cross-origin request from amoz-extension://context sends no cookies withoutcredentials: "include", host permission or not. The request reaches the API anonymously →-100.2 · Firefox ships MV3
host_permissionsOFF by default. Unlike Chrome, Firefox treats them as optional and does not grant them at install. In that state the fetches are CORS-blocked and throw, and the extension fails completely silently, no error in the popup, no notification (the rejection escapes theMANUAL_CLAIMlistener). The user has no way to discover the fix (about:addons → Permissions → enable hoyolab.com access).The fix
credentials: "include"on all ten HoYoLAB fetches inclaimable.ts. No-op on Chrome (it already attached cookies), required on Firefox.permissions.request(). On Chrome the check always passes and the banner never renders.How it was isolated
Tested on Zen with a real logged-in HoYoLAB session, temporary add-on loads of stock vs patched builds with the same extension id (so permission grants and storage carry over between them):
-100on every claimHappy to adjust style/wording to match the codebase conventions.
🤖 Generated with Claude Code