[BUG] SingleFile Asking Where To Save HTML Page Using Incognito

[cheese529]

Running the latest version of single file on the latest version of chrome on windows 11 and each time I try saving a page now while using incognito, it asks me where to save the file, never had this issue at all before, it used to automatically save to where my downloads folder is selected on chrome but now it asks me each time.

[gildas-lormeau]

Thank for the bug report. I confirm I was able to reproduce the issue. It's due to the fact that I changed the value of "incognito" from "spanning" to "split" in the manifest file. See https://developer.chrome.com/docs/extensions/reference/manifest/incognito for more info. I made this change for security purposes to make sure cookies won't leak when sending network requests (see #1606). However, this behavior seems to be a bug in Chrome. Normally, the “Save as” popup shouldn't be affected by this change.
I would have added an option to let the user choose the best compromise, but unfortunately this is technically impossible. The only solution is to publish a separate extension, or to revert the change in the manifest.json file and install manually the extension from the filesystem.

[cheese529]

Hey there, thank you so much for responding so quickly! You said that the only solution is to publish a separate extension, how easy would it be for someone with no knowledge of coding to be able to do this? Do I just remove the line of code which caused this change for each update you push out on github? Also what exactly are the repercussions of the cookies leaking - where exactly are they being leaked/sent to?

[gildas-lormeau]

It's quite easy if you install the extension manually. You just have to clone the project, replace split with spanning in the manifest.json file and install it as documented here: https://developer.chrome.com/docs/extensions/get-started/tutorial/hello-world#load-unpacked.

[gildas-lormeau]

Regarding cookies, if SingleFile downloads a page A with content served from a third-party domain, e.g. an user tracker, and then downloads another page B on another domain that has no link with page A, and this page B contains the same third-party content as page A, then the tracking code will know that the user has visited both pages. The split mode avoids this issue to happen.

[cheese529]

Oh so the only security issue is that they would know I visited the website? If that is the case then I am fine with that. Also thank you very much for explaining how I can edit the code and install the extension manually :)