Does Firefox have a standard API to check installation of specific Addons?

Question

I'm trying to detect the presense of certain addons that restrict functionality on our sites (such as Ghostery, or DoNotTrackMe), using plain JavaScript. If Firefox had a standard API to query for the existence of addons, it would short circuit my work. Probably something like:

AddonManager.getAddonByID('?')

Detection is possible for plugins such as Java and Flash (navigator.plugins), but not for addons, yet.

Detection is also possible if you are the developer of the addon.

Answer 1

You can detect AdBlock in FF, IE, Chrome

• http://adblockdetector.com/

You can detect FlashBlock in FF, IE, Chrome and others

• https://gist.github.com/artlung/1420308
• https://github.com/browserstack/flashblock-detector/blob/master/flashblock-detector.js

You can detect Ghostery in Chrome

• http://blog.securitee.org/?p=277

Please note these scripts use inference to detect the presense of these addons, there's no API. I haven't found detectors for other addons but they possibly exist.... (ongoing)

Answer 2

No, there is no such API and there won't be. If the browser allows websites to detect what extensions are installed then it is a bug and a privacy issue - Firefox and Chrome fixed such issues in the past, currently no such issues are supposed to exist. Why webpages shouldn't know this:

• The add-on list allows fairly precise fingerprinting of users and might allow tracking users even if cookies and similar mechanisms are disabled.
• Attacking vulnerabilities in extensions gets a lot simpler if a website can check in advance whether a vulnerable extension/extension version is installed. Same goes for social engineering attacks that rely on the presence of particular extensions.
• There is always a chance that websites decide to exclude website visitors that have unpopular software installed (ad blockers of all kinds, vulnerability scanners, download helpers etc).
• The list of installed extensions tells a lot about the user, his browsing habits and preferences - providing this information to websites would be a huge privacy issue.

navigator.plugins functionality shares many of the same issues of course - it was introduced in the dark ages of the internet back when nobody considered such issues. This is the reason why this functionality is being actively discussed and might get limited in future.

Now of course websites can still try to detect extensions by their effects. However, this isn't a very reliable approach, e.g. the Adblock detector you linked to says "no ad blocking detected" to me and is clearly wrong.

Bonus info: Google Chrome does provide a list of installed extensions but only to a single website: Chrome Web Store. The Web Store uses it to indicate which extensions you already installed. Whether it does anything beyond it with that data is something where your guess is as good as mine.