Problem

The current optional host permission situation has a few inconsistencies and limitations across browsers. Here are some:

• Safari does not grant host_permissions on install
• "all sites" optional permissions are generally treated as an invite to enable the extension on "all sites" at once¹
• offering "optional content scripts" requires manually dealing with permission grants and content script registration²

Proposal: "suggested hosts" and "available hosts"

These issues could be resolved with two additional well-defined top-level keys for the manifest. These two keys could replace (or be preferred to) host_permissions, optional_host_permissions and content_script.*.matches

suggested_hosts

• no permissions granted on install
• the browser will eventually prompt the user via badges (Firefox screenshot) and popups (Safari screenshot)
• the author can use permissions.request() and permissions.remove()

This is exactly how Safari currently treats host_permissions.

available_hosts

Like optional_host_permissions, but:

• the browser never prompts the user in any way
• the browser does not show a "enable on all sites" button/toggle

Example

This extension would show "No permissions requested" on install, then show a badge when the user visits YouTube. Optionally the user can enable the extension on any website that might be compatible.

{
	"name": "Watch History Collector",
	"description": "Tracks the titles of watched videos",
	"manifest_version": 3,
	"suggested_hosts": [
		"https://youtube.com",
		"https://vimeo.com",
	],
	"available_hosts": [
		"*://*/*"
	],
	"background": {
		"service_worker": "background.js"
	}
}

Follow-up for Safari

Safari does not support host_permissions the way it was defined, so they should mark the key as "Not supported; aliased to suggested_hosts"