Define disable policy for Permissions API? about webappsec-permissions-policy HOT 4 CLOSED

This is broader than the Permissions API, whose request() method is just a uniform interface to functions that exist elsewhere.

Feature-Policy: {"disable":["permissions"]}

should be equivalent to

Feature-Policy: {"disable":["geolocation", "midi", "notifications", "push", "webrtc"]}

except that if a future permission is added to the spec, it would be included in the disable list rather than omitted.

Both Feature-Policy: {"disable":["permissions"]} and Feature-Policy: {"disable":["geolocation"]} should leave navigator.permissions.query({name: 'geolocation'}) and navigator.permissions.request({name: 'geolocation'}) accessible and cause them to return {state: 'denied'}. On the other hand, navigator.geolocation.getCurrentLocation() shouldn't be accessible with either.

A possible syntax for re-enabling selected permissions is:

Feature-Policy: {"disable":["permissions"]}, {"enable":["geolocation"]}

which would be equivalent to

Feature-Policy: {"disable":["midi", "notifications", "push", "webrtc"]}

from webappsec-permissions-policy.

Yay, moar features to spec! Seriously though.. sounds reasonable. I like it.

@mikewest @raymeskhoury @noncombatant wdyt?

from webappsec-permissions-policy.

Overall sgtm :)

from webappsec-permissions-policy.

We're solving this case via "empty whitelist" approach -- see #43. Closing.

from webappsec-permissions-policy.