Manually add URL's to a container

[TriMoon]

• Multi-Account Containers Version: 6.2.3
• Operating System + Version: Kubuntu 19.10
• Firefox Version: Nightly Mozilla/5.0 (X11; Linux x86_64; rv:75.0) Gecko/20100101 Firefox/75.0 ID:20200229214828

Other installed Add-ons + Version + Enabled/Disabled-Status (Click to expand/hide)

About Sync 0.0.51
Amazon.com 1.1
Authenticator 6.0.1
Awesome RSS 1.3.5
Bing 1.1
CanvasBlocker 1.1 [DISABLED]
Certainly Something (Certificate Viewer) 1.2.3
Compat Report 0.1.0
Containers theme 1.0.3 [DISABLED]
Context Plus 0.6.0
Debian queries 2.3
Decentraleyes 2.0.13
Disconnect 5.19.3 [DISABLED]
DuckDuckGo 1.0
DuckDuckGo Privacy Essentials 2019.12.12 [DISABLED]
Emoji Cheatsheet for GitHub, Basecamp etc. 2.0.1
Enhancer for YouTube™ 2.0.99
Enterprise Policy Generator 5.1.0 [DISABLED]
Feedbro 4.0.3
Firefox DevTools ADB Extension 0.0.5
Firefox Lightbeam 2.1.0
Firefox Multi-Account Containers 6.2.3
FoxyProxy Standard 7.4.3
Google 1.0
Greasemonkey 4.9
HTTP/2 Indicator 3.0
IPFS Companion 2.10.0
Laboratory 3.0.7 [DISABLED]
MathML Font Settings 0.3.2
Native MathML 1.9.4
Nightly Tester Tools 4.0
Notes by Firefox 4.3.5 [DISABLED]
Offline QR Code Generator 1.6
PassFF 1.9.1 [DISABLED]
Plasma Integration 1.7
ProtonDB for Steam 1.6.0
React Developer Tools 4.4.0 [DISABLED]
Session Sync 3.1.12
Snooze Tabs 1.1.1
Tab Session Manager 5.2.0 [DISABLED]
To Google Translate 4.0.6
Tree Style Tab 3.3.6
True Sight 1.7.1
Twitter 1.0
Vue.js devtools 5.3.3
Wikipedia (en) 1.0
YouTube Container 1.3.0
eBay 1.0
uMatrix 1.4.0

Actual behavior

No way to add redirecting URL's.

• If you DON'T FORGET TO DO THIS EVERY TIME:
  • Only way at moment is to use right-click and choose a container.
  • Else you are screwed...

Expected behavior

To automatically open known redirect URI's we need a EASY way to add them to a container.
Sometimes you want to catch redirect links, to force them to always open in a certain container before the browser navigates to the destination of the link.
For this purpose we NEED a way to manually add URL's to a container of choice !

Steps to reproduce

1. Try to add a rule using the UI for links like https://go.microsoft.com/fwlink/?LinkID=xxxxx&wt.mc_id=fuckmedead
2. Stuck because there is no way.
3. Write bug report on github, like i do now 😉

Notes

Related issues: #719, #837, #839, #1057, #1075, #1180, #1335, #1317 and maybe many more im tired search now...

[fprochazka]

Yes please, this would make the extension amazing!

I want to be able to add amazon iam-account login links to containers, but they are redirects, which means there is no moment to intercept it and add as "always open" in a selected container.

This would allow me to:

setup:

• create new AWS IAM user, store the login link (which has account ID in its url) and login credentials to LastPass
• create a new Firefox Container for that AWS account, add the login link as always open in this container

usage:

• open LastPass window, search for the AWS account I want to log into, click the item
• LastPass opens the login link
• Firefox Containers intercepts the link and opens it appropriate container (to prevent login conflicts)
• LastPass fills in login credentials
• I submit the login form and I'm in the correct AWS account

[sherry13131]

Hi @kendallcorner, can you assign this issue to me?

[AdamJel]

Further to this:
The settings of 'limit to designated sites' in NOT currently synced. The site list is, but it is needed to tick the box again on new instance of Firefox. It would be very useful to synchronize this as well.
And I support the idea of having option to import/export/ settings = managing it by file, which may then be on a repo and thus having the ability to declaratively set the state. I already have quite a number of containers, so having the option to manage it by script (json) and having it backed-up on git would be nice.

[B00ze64]

I believe this would be better served by being added to Firefox, on the Options page, rather than in the tiny extension pop-up menus. This way we can have a large text box that we can edit and copy/paste into. This would also make moving container assignment to new profiles a matter of copy/pasting.

[AdamJel]

I believe this would be better served by being added to Firefox, on the Options page, rather than in the tiny extension pop-up menus. This way we can have a large text box that we can edit and copy/paste into. This would also make moving container assignment to new profiles a matter of copy/pasting.

Imagine you have 100+ containers. Then the matter of copy/pasting is not a pleasant option. On the other hand, one text file, beiing yaml, json or whatever, is easy enough.

And these two options dont exclude one another. It may be, that the window for copy pasting is just a gui for that text file.

For me, it would be extreamly pleasant to have just one descriptive text file and option to point extension to that file to load and set all containers, site lists included.

[B00ze64]

I agree with you. Never occurred to me someone would have that many containers lol, but of course Export/Import would be awesome. Right now settings are stored in IndexedDB. You can move that around (storage folder,) but because of ID's etc, it will probably not work in another profile. I still would appreciate a nice textbox, preferably in the options, where I can quickly add and remove stuff from within the browser, by just typing domains, and copy/paste stuff between containers etc. But if Import/Export uses yaml, json or whatnot that will do fine, we can edit that easily enough!

[jeremymeyers]

https://addons.mozilla.org/en-US/firefox/addon/simple-tab-groups/ handles this pretty well, and you can use a regex string too.

[EDIT to fix url]

[xdhmoore]

@jeremymeyers I think your link got wrong-linked...

[jeremymeyers]

@xdhmoore my bad. fixed now.

[hmlendea]

I am struggling with this because of redirects... It would be awesome if we could do it, as well as allowing wildards such as *.aliexpress.com

[grahamperrin]

#839

@TriMoon we have triplication of issues. Please, can you close this one? Leaving the automated cross-references in the earlier issues. Thank you.

[Korb]

I have mistakenly posted a similar proposal to bugzilla.mozilla.org. The full text can be read at the link I gave. In general, I support the proposal to add the ability to add dozens and hundreds of domains with all subdomains to containers in the same way as it is done with custom filters in ad blockers.

[comrademmirg]

I'm surprise to find this isn't a feature, could have a simple check box "always open this site in this container". Seriously, who on earth would want to manually select containers every time they open a new tab?

[mc0e]

Why has this been waiting so long? IT doesn't sound like there's disagreement with the proposal, and @sherry13131 offered to work on it.

[TriMoon]

#839

@TriMoon we have triplication of issues. Please, can you close this one? Leaving the automated cross-references in the earlier issues. Thank you.

There is a reason why issues stay open, even if duplicates exist.
(In which case it shows how wanted it is)

So I politely decline your request 😉

[kurahaupo]

@TriMoon
I desperately need this feature myself, but forking the commentary among many issues actually hurts rather than promotes it.

I can tell you from experience working on other projects that have many live bugs referring to the same underlying problem is TERRIBLE; it saps time and energy just dealing with bug triaging, leaving less and less time to work on fixing it.

If you want to make a bug more likely to be worked on, make it easier for prospective fixers to deal with the reports: add your comments to the existing bug, don't create new ones. Or if you have some variation that you think warrants a separate issue, and put detailed cross notes with the reference in the main issue, so that the coder who works on fixing it can see whether it's worthwhile reading the other bug to get some detail.

One bug report or feature request with 100 comments will be much more likely to get fixed that 3 bug reports with 33 comments each. And 3 bug reports with 100 comments are just going to annoy the fixer for wasting their time.

If it's so important to you that it transcends normal etiquette and good manners when dealing with volunteers, consider volunteering yourself to fix it.

[kurahaupo]

I note that issue #1833 is currently pinned, so it's much more likely to receive attention than any of these related bugs.

[kurahaupo]

I note that @sherry13131 did work on it and appears to have, if not a complete solution, at least a step in the right direction. However the PR has gone stale for 16 months and so I've rebased it against today's master and re-submitted it as PR #2114.

[sshquack]

Please provide this functionality to manually add a URL to a container. Here is my config:

• Firefox 95.0 (64-bit)
• MAC 8.0.3
• macOS monterey 12.0.1 on M1

[MadManMoon]

Additional Vote For Functionality

I also would absolutely like this functionality.

FF 99 Nightly
Win 10, Linux (i know) - Latest

I would also suggest the ability for other add-ons to address this one simply via API. So that programs such as firewalls, or script blockers like noscript, can assist in management of sites, and provide even deeper sandboxing of scripts and more per container.

---

The IndexedDB Database

Where is this IndexedDB file, and can I easily edit it in DB Browser (SQLite) or something? (as a scrappy workaround) I've had a look around (including the XPI) and can't find anything obvious.

Also, I have what I would've thought as more containers than most. Were 'ABE' still a thing in noscript (it will be again), I'd wholly like to have that and containers fully syncopatio.

I agree with you. Never occurred to me someone would have that many containers lol, but of course Export/Import would be awesome. Right now settings are stored in IndexedDB.

[mc0e]

Never occurred to me someone would have that many containers

The only reason I don't have hundreds of site specific containers is because of the awkwardness of the interface for making them work. This issue is a prime example.

I'd love it if I could have site-specific containers be the default, and created automatically, though I'm sure there would be many issues to work through.

[Eyjafjallajokull]

I use the Open external links in a container extension for this. You need to specify the Url in this format: ext+container:name=MyContainer&url='http://whatever'.

So, for example, I have this as the bookmarked Url for Microsoft 365 admin center: ext+container:name=Work+Admin&url=https://admin.microsoft.com/AdminPortal/Home#/homepage Clicking on the bookmark opens this in the "Work Admin" container.

@rakheshster Thank you for sharing, this is an awesome solution, saves me so much time working with many AWS accounts!

[achernyakevich-sc]

BTW, have we found a simple workaround yet that would allow us to manually add domains? E.g., by editing some JSON or SQLITE file outside the browser? Haven't had time to start grepping, yet, so wanted to check if someone else has already done so.

@xanoni There is Containerise add-on that probably will resolve your issue even simpler way. :)

[xanoni]

@xanoni There is Containerise add-on that probably will resolve your issue even simpler way. :)

Thank you, but I'm trying to keep my number of add-ons to a minimum (given security / complexity / etc.).

[bohdan-shulha]

Hi team,

Any updates on this?

Last year I started replacing Google stuff with some non-spying (/less-spying) alternatives. This year I want to focus on opensource or, at least, companies that contribute back to the community (Bitwarden was the very first in this journey).

I find Containers extremely useful (I have used to Chrome profiles and I like containers more), but the fact that I can't assign the redirect link to some container, makes them unsusable by a large factor.

I have seen a multiple PRs regarding this feature. One of them is still open - #2114.

Why this issue is not fixed for years? This is not the case when community doesn't want to contribute - this is, for sure, a very important feature that have got attention from lots of community members and developers. It is not going to break UX for a regular (non-engineering) user, but it will give devoted users a real tool.

:(

[tsbertalan]

I am unable to open e.g. Google Photos without disabling "limit to designated sites" for my Google container. It insists on taking me to through some redirection sequence every time, even if the container is logged in, and I enter some direct link into the app. (This of course is some idiotic design on Google's part--you can't directly type photos.google.com into the address bar and be in the app without first seeing some asinine marketing/landing page and having to click a button.)

[xanoni]

I am unable to open e.g. Google Photos without disabling "limit to designated sites" for my Google container. It insists on taking me to through some redirection sequence every time, even if the container is logged in, and I enter some direct link into the app. (This of course is some idiotic design on Google's part--you can't directly type photos.google.com into the address bar and be in the app without first seeing some asinine marketing/landing page and having to click a button.)

Yeah I think this is exactly the issue that others have been describing in various tickets over the past few years. Below is another workaround that I haven't seen mentioned, yet.

Steps:

1. Use your favorite search engine and look for "full list of Google subdomains" (should yield something like this here)
2. Choose a list of relevant subdomains, including those involved in the redirection process (if you're fast you can see them in the URL bar, otherwise use the inspector to observe what's going on)
3. For each of those subdomains, navigate your browser to an invalid resource (e.g., for the analytics subdomain you could go to https://analytics.google.com/foobar)
4. This should give you a 404 page instead of a redirection ... now you can add this domain to your container URL list and repeat the process with the other subdomains

Painful, but only has to be done once (until Google changes something ;-).

[xanoni]

Referring to my previous comment, I realized that it's not always possible to trigger a 404 response. Some servers will just always redirect to a different subdomain, even if you navigate to an invalid resource.

In that case, you can just disable redirects in your browser temporarily. In Firefox, there's a setting called network.http.redirection-limit in about:config for that (see here).

Just set it to 0 and you should be able to add the subdomain via the add-on menu. (EDIT: deleted one sentence that didn't help in this context here, lol.)

[mc0e]

While it would be useful to be able to manually add domains, it would still remain clumsy at best to identify the domains involved in redirects, navigate to the right containers and paste them in.

What would be really nice would be to be able to display a list of recent urls, that have been directed outside the container because they didn't match the domain list for the container, ideally including the whole redirect chain up to the point where the page did not redirect. I'd then want a clickable interface to add the domains that I'd prefer not to jump outside the originating container, and they'd get added to that container accordingly.

[tsbertalan]

@xanoni That 404 method sounds like just the workaround that will do it, thanks. I figured identifying the particular domains would not be too difficult, especially since people will have been complaining about this particular problem already, and you can just pull the domains from their posts.

@mc0e You're right that this would benefit from a better interface for getting the redirected domains. But, I expect that some sort of analysis paralysis is what has prevented this feature from being implemented, because it wasn't ever going to be implemented in the perfect way.

[influential-eliot]

Also, adding the domains to a container that is locked to the domains means that those domains will also ONLY open in that container ...

[philsnow]

Another workaround (because I found some sites where the 404 workaround doesn't apply) is to just go to the extension's inspector window and get/set the right records in the extension's localstorage. Write-up here: https://gist.github.com/philsnow/322bea2867d401171ada1c2eb7a38c89

[dry4ng]

I've been using multi-account containers for years and lack of this feature was always frustrating.

[tsbertalan]

Now, a couple months later--from @philsnow 's link, I used this snippet:

await ( async (prev, next) => {
  const prevURL = "siteContainerMap@@_" + prev;
  const nextURL = "siteContainerMap@@_" + next;
  await browser.storage.local.set({
    [nextURL]: (await browser.storage.local.get(prevURL))[prevURL]
  });
})("www.example.com", "SOMEWHERE.example.com") 

replacing www.example.com with www.google.com and also replacing SOMEWHERE.example.com with

1. login.youtube.com, and
2. accounts.youtube.com

I was able to defeat the login loop on YouTube. I'm not sure whether login or accounts did it; I was just guessing. I already had accounts.google.com added using the network.http.redirection-limit=0 trick, which was necessary but not sufficient.

[Zuccace]

In that case, you can just disable redirects in your browser temporarily. In Firefox, there's a setting called network.http.redirection-limit in about:config for that (see here).

Just set it to 0 and you should be able to add the subdomain via the add-on menu.

This seems to be the simplest route. Although I wouldn't call it simple by any means. But it works at least.

[influential-eliot]

Yeah, if were to allegorically speak in ITIL terms and say this whole thing was an incident (I know it isn't) ... then that is not a fix and it is barely a work around.

Plus, it's not something that general FireFox users will consider, in that it woud not even factor into their UX.

Sorry to just post negativity, it is not my usual thing. 😞

@Zuccace said:

This seems to be the simplest route. Although I wouldn't call it simple by any means. But it works at least.

@xanoni said:

In that case, you can just disable redirects in your browser temporarily. In Firefox, there's a setting called network.http.redirection-limit in about:config for that (see here).

Just set it to 0 and you should be able to add the subdomain via the add-on menu. (EDIT: deleted one sentence that didn't help in this context here, lol.)

[Zuccace]

Manually adding hosts would surely help, but as I just added yet another site to its own container, I encountered another problem: even if I gradually increased the redirect limit I seemed to miss one domain. I eventually brought up the inspector and from there opened a site in a new tab (with 0 redirect on). From there it was easy to add that domain to the correct container.
So there seem to be some javascript redirects on some sites that don't adhere to the (temporarily set) no-redirects setting.

The solution would be to have something to track which domains a tab has connected, then select and add sites from that list to the container.

[E14]

Manually adding hosts would surely help, but as I just added yet another site to its own container, I encountered another problem: even if I gradually increased the redirect limit I seemed to miss one domain. I eventually brought up the inspector and from there opened a site in a new tab (with 0 redirect on). From there it was easy to add that domain to the correct container. So there seem to be some javascript redirects on some sites that don't adhere to the (temporarily set) no-redirects setting.

The solution would be to have something to track which domains a tab has connected, then select and add sites from that list to the container.

The problem with those redirects is due to automated redirects to a domain that is (automatically) opened with a different container. That sounds to me like a security issue anyway, so FF (or the extension) should either ask the user what to do, with an option to add it to the current container, or just open it in the current container.

There is still an issue with javascript or meta forwards, but at least those are delayed somewhat and the user should be able to see the domain in between; Though if it's possible to catch those, I would do that as well.

---

For a workaround, I found it easier using the dev tools network tab. If you enable "persist logs" setting (in cogwheel dropdown), you will also see page redirects, this may be a bit easier to check than playing with redirect-limit.

For example if you go to http://google.com you'll get

301 GET google.com
200 GET www.google.com

Now if you're trying to add a new container, just do a full login cycle in a private browsing session (with dev tab open and logs persisting), then filter out all the gunk (images, css, js, xhr, ...) and you'll end up with a list of all domains involved.

[Zuccace]

The problem with those redirects is due to automated redirects to a domain that is (automatically) opened with a different container. That sounds to me like a security issue anyway, so FF (or the extension) should either ask the user what to do, with an option to add it to the current container, or just open it in the current container.

Containers leaking data is a security issue.

[influential-eliot]

Agreed 100% !
@Zuccace said:

Containers leaking data is a security issue.

... ... although I could've sworn I saw Firefox handle the 'login' part of all of this automatically the other day.

Basically, I was in one container, it opened the login in another, then closed that and refreshed the original to finish the login process.

So it's possible that Moz are in the midst of handling the 'login flow over a different domain' thing which is a part of this multi-faceted request.

[E14]

Containers leaking data is a security issue.

Agreed, but containers and MAC in particular seem to be going the tab groups route from the core team support I'm seeing here.

Basically, I was in one container, it opened the login in another, then closed that and refreshed the original to finish the login process.

Maybe you were previously logged-in in the origin container and just authorized the app? Logins need to set cookies and those definitely should not be shared across containers, that's the whole point

[enikkari]

Easy workaround to manually add a redirecting url:

1. disconnect internet / wifi
2. put in url bar the url & hit enter
3. site is of course not found or redirected, add to container
4. Reconnect internet, done :D

I used this to add manually my different AWS accounts to the multi account containers. Or any other link where the url redirects
https://account-id.signin.aws.amazon.com/console

edit: I posted this workaround to help others since it took me some hours to figure out a way to do this and I thought it could help others. It seems this comment has rubbed some people the wrong way. It was not my intention in any way to hurt or annoy anyone, only to help others like me that stumble onto this message thread.

[influential-eliot]

Very helpful, but this is obviously not a reason to close this.

@enikkari said:

Easy workaround to manually add a redirecting url:

disconnect internet / wifi
put in url bar the url & hit enter
site is of course not found or redirected, add to container
Reconnect internet, done :D

I used this to add manually my different AWS accounts to the multi account containers. Or any other link where the url redirects
https://.signin.aws.amazon.com/console

[kurahaupo]

@enikkari It's a good option for those who can do that, but "shutting off the internet connection" is unreasonable where it would disrupt persistent connections such as ssh or irc. A more targetted approach that only blocks new TCP connections would be preferable. One way to do this on Linux is using iptables. To start blocking use:

sudo iptables -I OUTPUT ! -o lo -p tcp --syn -j REJECT --reject-with icmp-admin-prohibited

To unblock change -I to -D:

sudo iptables -D OUTPUT ! -o lo -p tcp --syn -j REJECT --reject-with icmp-admin-prohibited

You can use -j DROP instead of -j REJECT --reject-with icmp-admin-prohibited, but it'll be much slower, as Firefox will have to wait for each connection attempt to time out.

The ! -o lo means don't block loopback traffic, since there are undoubtedly local activities you don't want to disrupt.