Issue metadata
Sign in to add a comment
|
Permission Delegation API for Iframes |
||||||||||||||||||||||||||||||||||||||||||||
Issue descriptionSee https://noncombatant.github.io/permission-delegation-api/ Change description: There are two main changes proposed: -Give an embedding page the ability to delegate permissions (such as geolocation) to iframes that are embedded within it. We introduce 2 mechanisms to do this: a) an <iframe> attribute (e.g. <iframe permissions=”geolocation …”>; and b) a JS API to programmatically delegate permissions. -Impose a restriction which prevents iframes from acquiring a permission unless the iframe’s embedder has explicitly delegated it. Changes to API surface: Initially add a "permissions=" attribute to the <iframe> tag. An imperative API is also planned. Links: Spec: https://noncombatant.github.io/permission-delegation-api/ Public standards discussion: https://lists.w3.org/Archives/Public/public-webappsec/2016Apr/0041.html https://lists.w3.org/Archives/Public/public-webappsec/2016Mar/thread.html#msg34 Doc: https://docs.google.com/document/d/1iaocsSuVrU11FFzZwy7EnJNOwxhAHMroWSOEERw5hO0/edit Support in other browsers: None *Make sure to fill in any labels with a -?, including all OSes this change affects. Feel free to leave other labels at the defaults.
,
May 25 2016
,
Mar 8 2017
,
Aug 23
This proposal will enable delegation of trust that may be prohibited by NDA, local laws etc. User agent should have an option to disable this behavior.
,
Dec 10
This seems like a security problem. Support I visit website A, and I deny a permission to it. I also like to visit website B, which I do grant a permission for. I have never seen website A on website B. Then one day, website B decides to put website A inside an iframe for some reason or other, and now all of a sudden website A has the permission that I did not want it to have. Not good! |
|||||||||||||||||||||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||||||||||||||||||||
Comment 1 by raymes@chromium.org
, May 18 2016