Feature-Policy ∪ Permission Delegation ∪ Origin Trials about webappsec-permissions-policy HOT 5 CLOSED

I like it. I think we should flip the default for cascading though. cascade should be opt-out.

Also, we need a disable attribute on iframe as well?

from webappsec-permissions-policy.

I like it. I think we should flip the default for cascading though. cascade should be opt-out.

Yep, that's what we have currently: http://igrigorik.github.io/feature-policy/#the-target-member

Also, we need a disable attribute on iframe as well?

Yep, see: #11

from webappsec-permissions-policy.

Had an offline chat with @jpchase @clelland @mkruisselbrink today. Quick summary:

1. The rough integration sketch in #10 (comment) sounds reasonable.
   • One concern is lack of <meta> support, opened: #15.
   • The algorithm that processes tokens probably shouldn't call out to Origin Trials specifically, instead just provide an extension point for other specs to hook into.
2. We talked about pro's and con's of hiding interfaces/methods vs throwing exceptions. Agreed that it probably makes sense to hide interfaces for cases like "disable webrtc", less clear on "disable document.cookie" and similar... Need to think about it some more.

Overall though, I think we agreed that it makes sense to explore this further.

Next step: convert #10 (comment) into a concrete proposal.

p.s. @jpchase @clelland @mkruisselbrink please chime in if I'm forgetting anything.

from webappsec-permissions-policy.

Hmm would safer defaults be for enable features not to cascade but disabled features to cascade?

from webappsec-permissions-policy.

Closing this; we broke out the various pieces of #9 (comment) into separate threads.

from webappsec-permissions-policy.