'focus-without-user-activation' permissions policy

[siliu1]

こんにちは TAG-さん!

I'm requesting a TAG review of a new permissions policy named 'focus-without-user-activation'.

The focus-without-user-activation permissions policy help controls the use of automated focus in a main frame or <iframe>. The proposed permissions policy can be used to limit the use of automatic focus. Essentially, when the policy is disabled in a document, scripted and automatic focus will only work if the focus has been initialized through user activation. This essentially means that autofocus will be disabled (unless a new element is inserted, with autofocus, as a result of user gesture). The scripted focus will also only work if it has started with user gesture or initiated from current frame's parent.

• Explainer¹: https://github.com/gabrielsanbrito/webappsec-permissions-policy/blob/main/policies/focus-without-user-activation.md
• Specification: Feature Policy: focus-without-user-activation whatwg/html#10672
• WPT Tests:
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy-cross-origin.tentative.https.sub.html?label=experimental&label=master&aligned, https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy.tentative.https.sub.html?label=experimental&label=master&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-tentative.html?label=master&label=experimental&aligned
  • https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
• User research: N/A
• Security and Privacy self-review²:
• GitHub repo: https://github.com/w3c/webappsec-permissions-policy, https://github.com/whatwg/html
• Primary contacts:
  • Fernando Fiori (@ffiori), Microsoft, implementer
  • Siye Liu (@siliu1), Microsoft, implementer
• Organization/project driving the specification: Microsoft
• Multi-stakeholder support³:
  • Chromium comments: https://chromestatus.com/feature/5179186249465856
  • Mozilla comments: focus-without-user-activation feature policy mozilla/standards-positions#1080
  • WebKit comments: focus-without-user-activation feature policy WebKit/standards-positions#406
• Status/issue trackers for implementations⁴: https://chromestatus.com/feature/5179186249465856

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• Previous early design review, if any: https://github.com/w3ctag/design-reviews/issues/####
• Relevant time constraints or deadlines:
• The group where the work on this specification is currently being done:
• The group where standardization of this work is intended to be done (if different from the current group):
• Major unresolved issues with or opposition to this specification:
• This work is being funded by: