According to the specification¹, when the 'maximumAge' parameter of a
call to getCurrentPosition() is not explicitly set, its value defaults
to 0, which instructs the user agent to request a new position, and not
return a cached one.

However pages that call getCurrentPosition() with a maximumAge parameter
> 0 might get a cached location, without your explicit consent.

That said, I had a look at the code at http://www.where-am-i.net/, and
it appears getCurrentPosition() is called without a maximumAge
parameter, so it should not disclose a cached location, instead it
should always try to get a fresh position.

Assuming this is correctly implemented in chromium (which the browser’s
web engine uses under the hood), the issue could be somewhere else in
the stack (maybe the location provider returning a stale position with a
fresh timestamp?). This is merely a conjecture, more investigation is
needed. I’m tentatively adding an ubuntu-location-service task.


¹ https://dev.w3.org/geo/api/spec-source.html#position_options_interface

** Also affects: location-service (Ubuntu)
   Importance: Undecided
       Status: New

** Changed in: webbrowser-app (Ubuntu)
       Status: New => Invalid

** Also affects: oxide
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to location-service in Ubuntu.
https://bugs.launchpad.net/bugs/1551686

Title:
  browser leaks old location data to web pages

To manage notifications about this bug go to:
https://bugs.launchpad.net/oxide/+bug/1551686/+subscriptions

-- 
desktop-bugs mailing list
desktop-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs

Reply via email to