A policy to force temporary permissions about webappsec-permissions-policy HOT 6 OPEN

As it stands, I think the plan is to require the FP policy to be present on every response - i.e. there is no persistence of the policy across pages. Does that address this?

from webappsec-permissions-policy.

Sorry, the issue @noncombatant pointed out was that if a Feature-Policy allows a particular permission, say "camera", then a jsfiddle page could request and be granted it. Then the user opens another jsfiddle page, which will likely have the same Feature-Policy since it's the same site, and Chrome would have defaulted to saving the granted permission. However, that persistence isn't a good idea on this particular site.

from webappsec-permissions-policy.

Sorry, the issue @noncombatant pointed out was that if a Feature-Policy allows a particular permission, say "camera", then a jsfiddle page could request and be granted it.

Isn't that more of a permissions API question? Sounds like you want to grant a ~one time permission, or some such? I guess it's not clear to me how Feature Policy helps or hinders here.

from webappsec-permissions-policy.

On jsfiddle, whoever writes the path controls what javascript runs, so while the permissions API could let those authors ask for temporary access, it would also let them ask for permanent access. To control the behavior of the authors, there'd need to be a header that the overall server sets.

I don't think this is high priority, but wanted to think about it publicly.

from webappsec-permissions-policy.

Ah, ok.. with you now, thanks for the patience :)

from webappsec-permissions-policy.

I think this is a really great idea. I agree it's not high priority, but I think it would be a great thing to have (e.g. have a feature which is "persistent permissions"). I never want to persist a decision for jsfiddle :)

from webappsec-permissions-policy.