Back in the Feature Policy days, one could set either the HTTP header or the "allow" a

Wait, apologies, <a class="user-mention notranslate" data-hovercard-type="user" data-h

geolocation-API: Cross-origin permissions policy tests need to set the "allow" attribute about wpt HOT 3 CLOSED

rakuco commented on June 16, 2024

geolocation-API: Cross-origin permissions policy tests need to set the "allow" attribute

from wpt.

reillyeon commented on June 16, 2024

I started looking at this but found a broader systemic issue with how these tests are running on the Chromium CI: https://crbug.com/331556923

I haven't tried running this with the upstream WPT runner.

from wpt.

marcoscaceres commented on June 16, 2024

setting only the HTTP header is not enough and one needs to set the "allow" attribute as well

That... doesn't sound right? That seems like a foot gun.

@clelland is that correct?

from wpt.

marcoscaceres commented on June 16, 2024

Wait, apologies, @rakuco... I think I misread. Setting the allow attribute on the iframe makes sense.

Setting the HTTP header only applies to the top level document, which makes perfect sense... it shouldn’t inherit down to cross origin frames.

from wpt.