'focus-without-user-activation' permissions policy

[siliu1]

こんにちは TAG-さん!

I'm requesting a TAG review of a new permissions policy named 'focus-without-user-activation'.

The focus-without-user-activation permissions policy help controls the use of automated focus in a main frame or <iframe>. The proposed permissions policy can be used to limit the use of automatic focus. Essentially, when the policy is disabled in a document, scripted and automatic focus will only work if the focus has been initialized through user activation. This essentially means that autofocus will be disabled (unless a new element is inserted, with autofocus, as a result of user gesture). The scripted focus will also only work if it has started with user gesture or initiated from current frame's parent.

• Explainer¹: https://github.com/gabrielsanbrito/webappsec-permissions-policy/blob/main/policies/focus-without-user-activation.md
• Specification: Feature Policy: focus-without-user-activation whatwg/html#10672
• WPT Tests:
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy-cross-origin.tentative.https.sub.html?label=experimental&label=master&aligned, https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy.tentative.https.sub.html?label=experimental&label=master&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-tentative.html?label=master&label=experimental&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
• User research: N/A
• Security and Privacy self-review²:
• GitHub repo: https://github.com/w3c/webappsec-permissions-policy, https://github.com/whatwg/html
• Primary contacts:
  • Fernando Fiori (@ffiori), Microsoft, implementer
  • Siye Liu (@siliu1), Microsoft, implementer
• Organization/project driving the specification: Microsoft
• Multi-stakeholder support³:
  • Chromium comments: https://chromestatus.com/feature/5179186249465856
  • Mozilla comments: focus-without-user-activation feature policy mozilla/standards-positions#1080
  • WebKit comments: focus-without-user-activation feature policy WebKit/standards-positions#406
• Status/issue trackers for implementations⁴: https://chromestatus.com/feature/5179186249465856

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• Previous early design review, if any: https://github.com/w3ctag/design-reviews/issues/####
• Relevant time constraints or deadlines:
• The group where the work on this specification is currently being done:
• The group where standardization of this work is intended to be done (if different from the current group):
• Major unresolved issues with or opposition to this specification:
• This work is being funded by:

[matatk]

Hi @siliu1, and thanks for your review request.

We are supportive of this use case, and your proposed approach seems reasonable.

However, it would be really helpful for reviewers if you could include the alternatives that were considered in the explainer, and briefly describe why they were rejected.

We are aware of a few alternative approaches that had been explored (thanks @dandclark for highlighting these):

• The disallowprogrammaticfocus attribute. (Described in a draft explainer).

• The alternative policy name from the same draft explainer. (For this one it does seem logical to use the existing focus-without-user-activation name, which we understand was suggested during discussions in the WG.)

• A sandbox flag (as per Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273).

Please could you add these - and the reasons for rejecting them - to the explainer?

Thanks again to @dandclark for assisting with this review.