html icon indicating copy to clipboard operation
html copied to clipboard
verified publisher icon whatwg

Feature Policy: `focus-without-user-activation`

Open siliu1 opened this issue 1 year ago • 4 comments

focus-without-user-activation is a new feature policy that can be used to block programmatic focus changes that are not triggered through user activation (explainer).

The motivation behind this feature policy is to provide better security for websites that embed third party contexts.

This change makes modifications to the following focus API:

  • autofocus
  • element.focus(options)
  • window.focus()

The WHATWG resolved to add a new feature policy, focus-without-user-activation, to control whether third-party iframes can take focus programmatically. (https://github.com/w3c/webappsec-permissions-policy/issues/273#issuecomment-2384287101)

The original PR contains all prior discussions regarding the feature policy. However, since I don't have editor access to it, I've created this new PR.

(See WHATWG Working Mode: Changes for more details.)

/acknowledgements.html ( diff ) /infrastructure.html ( diff ) /interaction.html ( diff ) /interactive-elements.html ( diff ) /popover.html ( diff )

siliu1 avatar Oct 03 '24 17:10 siliu1

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

zcorpan avatar Oct 16 '24 11:10 zcorpan

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

siliu1 avatar Oct 16 '24 16:10 siliu1

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

There seem to be more APIs than just the above ones that reference "focusing steps".

[#focusing-steps](https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps)

Referenced in:
[2.1.4 DOM trees](https://html.spec.whatwg.org/multipage/infrastructure.html#dom-trees:focusing-steps)
[4.10.20.2 Constraint validation](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#constraint-validation:focusing-steps)
[4.10.20.3 The constraint validation API](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#the-constraint-validation-api:focusing-steps)
[4.11.3.7 Using the accesskey attribute to define a command on other elements](https://html.spec.whatwg.org/multipage/interactive-elements.html#using-the-accesskey-attribute-to-define-a-command-on-other-elements:focusing-steps)
[4.11.4 The dialog element](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps-2)
[6.6.2 Data model](https://html.spec.whatwg.org/multipage/interaction.html#data-model:focusing-steps)
[6.6.4 Processing model](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-2) [(3)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-3) [(4)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-4)
[6.6.5 Sequential focus navigation](https://html.spec.whatwg.org/multipage/interaction.html#sequential-focus-navigation:focusing-steps)
[6.6.6 Focus management APIs](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps-2)
[6.6.7 The autofocus attribute](https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute:focusing-steps)
[6.8.2 Making entire documents editable: the designMode getter and setter](https://html.spec.whatwg.org/multipage/interaction.html#making-entire-documents-editable:-the-designmode-idl-attribute:focusing-steps)
[6.12 The popover attribute](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps-2)
[7.2.6.8 Ongoing navigation tracking](https://html.spec.whatwg.org/multipage/nav-history-apis.html#ongoing-navigation-tracking:focusing-steps)
[7.2.6.10.4 Scroll and focus behavior](https://html.spec.whatwg.org/multipage/nav-history-apis.html#navigate-event-scroll-focus:focusing-steps)
[7.4.6.4 Scrolling to a fragment](https://html.spec.whatwg.org/multipage/browsing-the-web.html#scrolling-to-a-fragment:focusing-steps)
[8.1.7.3 Processing model](https://html.spec.whatwg.org/multipage/webappapis.html#event-loop-processing-model:focusing-steps)

Were you able to go through all of them and confirm that the ones you are updating herewith are the only ones that need updates?

sanketj avatar Oct 18 '24 05:10 sanketj

(See WHATWG Working Mode: Changes for more details.)

Could you mark the entries in the checklist that have been completed via [x]? For the ones that are not complete, could you try to complete them? (Ex. filing implementation bugs on Gecko and WebKit)

sanketj avatar Oct 18 '24 05:10 sanketj

@annevk I addressed all your feedback. Please let me know if we can merge this PR. Thank you!

siliu1 avatar Mar 04 '25 22:03 siliu1

@annevk Just checking if you had any more feedback on this one?

@zcorpan Were you planning on reviewing this as well?

sanketj avatar Mar 06 '25 18:03 sanketj

@siliu1 @sanketj there should also have been a PR to rename the tests away from .tentative. I haven't blocked on that this time but please make sure that is there next time around. And please rename the tests away from .tentative as soon as possible. Thanks!

annevk avatar Mar 07 '25 14:03 annevk

Thanks @siliu1 and @annevk for your contributions. Shall we consider original proposals https://github.com/whatwg/html/issues/4326 and https://github.com/w3c/webappsec-permissions-policy/issues/273 as done now or is there anything else to be done?

marian-r avatar Mar 07 '25 19:03 marian-r

Thanks @siliu1 and @annevk for your contributions. Shall we consider original proposals #4326 and w3c/webappsec-permissions-policy#273 as done now or is there anything else to be done?

Yeah, I think we can close the original issues https://github.com/whatwg/html/issues/4326 and https://github.com/w3c/webappsec-permissions-policy/issues/273.

siliu1 avatar Mar 07 '25 19:03 siliu1

@siliu1 @sanketj there should also have been a PR to rename the tests away from .tentative. I haven't blocked on that this time but please make sure that is there next time around. And please rename the tests away from .tentative as soon as possible. Thanks!

Thanks @annevk! This should be taken care of now. Any thoughts on updating the PR template to remind people to mark their tests non-tentative?

sanketj avatar Mar 07 '25 20:03 sanketj

There is a reminder in a source comment: https://github.com/whatwg/html/blob/main/PULL_REQUEST_TEMPLATE.md?plain=1

annevk avatar Mar 08 '25 07:03 annevk