2

Is there a way to install a Google Doc add-on and limit its access, so it can only access specific documents that I have designated (rather than gaining access to all of my documents)?

I am trying to limit the risk, when using an add-on from an unknown author, and wondering what options are available to me. If there was a way to install an add-on on an opt-in basis, so it only gains access to documents where I have enabled the add-on, that would provide some helpful risk mitigation.

Improve this question

1 Answer 1

Reset to default
2

It doesn't depend on you, the user installing the add-on. It depends on the add-on developer.

Google Editor add-ons are created using Google Apps Script. Google Apps Script project creators / editors might add a JSDoc annotation to limit the add-on access only to the document where the add-on was activated.

/**
 * @OnlyCurrentDoc
 */

For details, see Authorization for Google Services.

The add-on developer should tell their add-on audience the required permissions and explain why they are required. Still, the authorization process will show the OAuth authorization screen showing the authorizations that will be granted.

Improve this answer
7
  • Thank you! I'm confused by what I read there. I don't know what it means for an add-on to get access only "to files in which the add-on [..] is used" (what determines whether a file is considered "used" by the add-on?). Maybe if the add-on hasn't declared @OnlyCurrentDoc, the add-on only gains access to a document if I click on one of the menu items associated with that add-on while that document is open? Can you help me understand the implications of the documentation there? Or would it be better for me to ask a new question?
    – D.W.
    Commented Oct 30, 2023 at 1:14
  • @D.W. IIRC I already answered that... not sure if it was on SO or if it was on mentoring session. Give me moment to see if I can find the SO question
    – Rubén - Volunteer Moderator - ♦
    Commented Oct 30, 2023 at 1:15
  • @D.W. This is not exactly the answer that I was looking for but it's the same question follow-up Do Add-ons Travel with Google-Docs?
    – Rubén - Volunteer Moderator - ♦
    Commented Oct 30, 2023 at 1:21
  • Thank you for your time and attention to this! I am struggling to understand the implications of that for my question and for security risks. Does this mean that all Docs add-ons are already "opt-in" on a per-document basis, in the sense that the add-on only gains access to a document once a user clicks on a menu item to enable the add-on on that document, and the add-on doesn't have access to other documents where no one has clicked on the menu item?
    – D.W.
    Commented Oct 30, 2023 at 1:26
  • It's not as simple as that because add-ons could install time-driven triggers. From a security risk perspective, one of these triggers might access all your documents, in Google Drive, when your computer is turned off.
    – Rubén - Volunteer Moderator - ♦
    Commented Oct 30, 2023 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.