Summary: People don’t have a good understanding of iframes, because
generally, no UI indicates that iframes are visible on a page, or what
their origin is. Permission requests from iframes cause significant
confusion for users because it is hard to determine where the requests come
from, as the address bar does not match the site in the permission prompt.
Currently, Firefox allows iframes on a site to make permission requests and
show up a permission prompt using the origin of the iframes. A user making
a decision based on the third party context presented in the notification
prompt is complicated and confusing. This confusion is exacerbated when
managing previously stored permission decisions.
To address this problem, we would like to impose a restriction on
permissions coming from third party context. There would be two main
changes proposed:
-
Give an ability to delegate permissions from first party to third party
embedded iframes, and impose a restriction to embedded iframes to request
permission only when the iframe’s embedder has explicitly delegated it. The
permission request will use the top level origin to show in the prompt,
then users are only required to make permission decisions about the first
party context.
-
This change is dependent on the ability of Feature Policy to disable
permissions by default in cross-origin iframes. It will require a site to
explicitly allow permissions for cross-origin iframes (setting allow
attribute, e.g allow=”geolocation”) otherwise, the permission
requests will
be denied on that iframes.
-
The change will be applied to geolocation, camera, microphone and
screen-sharing permission, and fullscreen request.
-
Completely deny permissions from third party context for vibration,
notification, and persistent-storage permission.
The plan is:
-
Enable Feature Policy allow attribute.
-
Make permission camera/microphone/geolocation/display-capture/fullscreen
disabled by default in third-party iframe.
-
Delegate Permissions: only cross-origin iframes that have explicit
delegated permission from their parent through the allow attribute will
have the right to make permission requests.
-
Reduce the number of supported features to geolocation, camera,
microphone screen-sharing, and fullscreen (the above features are supported
for permissions UI with notification prompts, except fullscreen). And we
will move all other features to experimental phrase under a user preference
which is disabled by default.
-
Simplify prompts/dialogs to only contain the top-level origin.
-
Deny vibration, persistent-storage permission from third party iframe
(notification permission was disabled in third party context, just do some
minor refactors).
Bug: The tracking bug https://bugzilla.mozilla.org/show_bug.cgi?id=1572461
Standard: Feature Policy
https://w3c.github.io/webappsec-feature-policy/#iframe-allow-attribute
Platform coverage: All.
Preference:
dom.security.featurePolicy.experimental.enabled: disabled by default, we
will limit supported features in Feature Policy to geolocation, camera,
microphone, fullscreen, display-capture and move others to experimental
phase.
permissions.delegate.enabled: enabled by default
dom.security.featurePolicy.enabled: this pref is implemented in Firefox 65
but enabled by default in Nightly only
Other browsers: Chrome supports permission delegation from Chrome 71.
web-platform-tests: We only have web platform tests for feature policy but
not permission delegation
Some of Feature Policy web-platform-tests that the permissions are disabled
by default in cross origin iframe:
https://searchfox.org/mozilla-central/source/testing/web-platform/meta/feature-policy
testing <https://searchfox.org/mozilla-central/source/testing>/web-platform
<https://searchfox.org/mozilla-central/source/testing/web-platform>/tests
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests>/
permissions
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests/permissions>
/feature-policy-permissions-query.html
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests/permissions/feature-policy-permissions-query.html>
testing <https://searchfox.org/mozilla-central/source/testing>/web-platform
<https://searchfox.org/mozilla-central/source/testing/web-platform>/tests
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests>/
mediacapture-streams
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests/mediacapture-streams>
/MediaStream-default-feature-policy.https.html
<https://searchfox.org/mozilla-central/source/testing/web-platform/tests/mediacapture-streams/MediaStream-default-feature-policy.https.html>
testing/web-platform/tests/mediacapture-streams/MediaDevices-enumerateDevices-not-allowed-mic.https.html
<https://phabricator.services.mozilla.com/D42958#change-R6vBFB8IJIFC>
testing/web-platform/tests/mediacapture-streams/MediaDevices-enumerateDevices-not-allowed-camera.https.html
<https://phabricator.services.mozilla.com/D42958#change-7eOHWcqTIeBw>
testing/web-platform/tests/mediacapture-streams/MediaDevices-enumerateDevices.https.html
<https://phabricator.services.mozilla.com/D42958#change-pqamxq3whbwg>
Secure contexts: yes.
Is this feature enabled by default in sandboxed iframes? Yes
--
Best regards,
=====================================================
Thomas Nguyen
IRC : tngu...@irc.mozilla.com
Slack: tnguyen
Email: tngu...@mozilla.com
=====================================================
_______________________________________________
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform
