Why this app wants these permissions?

[HFPasfho]

Unfortunately this repo doesn't list all app's permissions with explanation why they are needed and I don't understand why some of them are required. It would be great if someone, preferably the dev would tell my why this app needs:

1. access approximate location
2. access precise location
3. to appear on top of other apps
4. prevent phone from sleeping
5. run at startup

Considering app's description and its purpose these permissions doesn't seem to be obviously needed. I'm not suggesting anything but these particular permissions always are concerning.

Requirement of
a. run foreground services
b. ignore battery optimizations
is also unclear for me but I guess the first one is vital for running users tasks. The second one isn't so scary but I wonder why battery optimization would disturb sending a simple http request.

Thanks in advance for explaining this for me and probably others.

[Waboodoo]

Hi,
You raise a fair point, I should document these better. Until I've done that, here's a summary of the app's permission needs:

1. access approximate location: The app needs this permission for 2 of its non-essential features:

• An HTTP shortcut can be configured to only run when the device is connected to a specific wifi. On Android, an app needs the location permission to access the wifi's name.
• As part of the Scripting feature, you can create a workflow that looks up the device's current location and uses that as part of the HTTP request, e.g. if you want to include your current coordinates in a request body or similar.

This being the most privacy-sensitive of the used permissions, it is also documented and explained in the Privacy Policy.

2. access precise location: Same as 1. Again, it's non-essential. You can use the app without granting this permission, you just won't be able to make use of the 2 features I mention above. The device's location isn't used for anything else.

3. appear on top of other apps: This one isn't required in most cases, i.e., you can use the app without granting it. You might need it though if you want to integrate with 3rd party apps such as Tasker, Automate or MacroDroid. This is due to a technical limitation of the Android system.

4. prevent phone from sleeping: This one I'm actually not sure why it's there. I'll have to look into that, it might not be needed. As far as I know, I'm not requesting this one specifically. My suspicion is that it is used for the 3rd party integration plugin as well.

5. run at startup: There is a feature that allows you to periodically run an HTTP Shortcut. To make sure that this periodic scheduling keeps working after a reboot, this permission is required to restart the schedule. Again, non-essential, if you don't make use of periodic requests, then this won't be used.

a. run foreground services: When running a request, the app needs to make sure that the request isn't stopped by the Android system, thus it requires this permission so it can keep a service running while an HTTP request is ongoing.

b. ignore battery optimizations: This one is also part of the periodic requests feature. The Android system will normally stop scheduled tasks like this to preserve battery. The user has to explicitly excempt an app from this, or otherwise scheduled tasks will just stop working. As such, this is also a non-essential permission, as it's only needed for this one feature.

I hope this made it a bit clearer. On the surface, as you say, this app is sending simple HTTP requests, and yes, for that it doesn't need any of these permissions. However, the app has a ton of hidden features for advanced or very specific use cases, which is why it needs a few specific permissions to enable those if the user wishes to make use of them.

[HFPasfho]

Thank you so much for quick and detailed explanation. Actually judging by how you handle communication with your userbase in other issues and discussions I didn't suspect anything malicious. Seriously this is really excellent job and I wish other FOSS projects were so open and communicative. However as they say "better safe than sorry" so I hope such list will find its way to readme and app description in F-Droid anytime soon.

Thank you for your excellent app. Keep up the great work!

[Waboodoo]

I've now added a page to the documentation that explains the use of the permissions: https://http-shortcuts.rmy.ch/permissions