Allow subdomains with Firefox canvas fingerprinting

Question

Firefox has fingerprinting protection (currently experimental). Some sites that use the canvas don't render properly. For example, the terminal in GitHub Codespaces looks garbled until an exception is added. You can add exceptions for sites that you trust.

Codespaces in particular becomes difficult to use: each space is given its own subdomain like your-space.github.dev, so when granting permission to read from the canvas, it only applies to that space. Creating a new space becomes an awkward dance of create, wait for it to be created and load, add permission, reload, wait for it to reconnect.

How can I add canvas permission for any subdomain of github.dev?

Answer 1

It turns out that subdomains inherit the canvas permission from their parents¹, so you just need to allow it for github.dev. Unfortunately in this case, github.dev doesn't use a canvas so Firefox doesn't give the option to allow it. Instead:

1. Create a Codespace.

2. Grant it permission to read the canvas.

3. Backup your permissions.sqlite in your profile directory.

4. Modify your profile's permissions.sqlite file² to remove the subdomain from the github.dev entry. For example, using sqlite3:

   sqlite3 permissions.sqlite
   

   update moz_perms
     set origin = "https://github.dev"
     where origin = "https://your-space.github.dev";
   

¹ The permission is checked with TestPermissionFromPrincipal, which doesn't require an exact hostname match, so if the permission isn't set for a subdomain the parent domain is also checked.

² Editing the permissions database is described in this Bugzilla comment.