Intent to Ship: web-share permission policy

[Eric Willigers]

Contact emails

ericwi...@chromium.org, fin...@chromium.org

Explainer

https://github.com/w3c/web-share/blob/master/docs/explainer.md

Specification

https://w3c.github.io/web-share/#permissions-policy

Summary

A new permission policy, "web-share", controls access to navigator.share().

The default allowlist is 'self', avoiding possible abuse by third party iframes.

Link to blink-dev discussion

https://groups.google.com/a/chromium.org/g/blink-dev/c/fgme9KOd8CU/m/TCYPKQAXAwAJ

Blink component
Blink>WebShare

TAG review

Not needed, trivial change to existing spec

TAG review status

Not applicable

Risks

Interoperability and Compatibility

navigator.share() is called by embedded iframes. These may expect share() calls to succeed, when now they will fail if permission has not been granted.

Firefox has successfully shipped the feature.

Failures were observed with YouTube, these have now been addressed. 

Gecko: Shipped/Shipping (https://github.com/w3c/web-share/pull/252)

WebKit: Shipped/Shipping (https://github.com/w3c/web-share/issues/169) CL recently merged: https://github.com/WebKit/WebKit/commit/ded7a6094a6ca38833e63a7915b7b6a2832f5734

Web developers: No signals

Other signals:

WebView application risks

Does this intent deprecate or change behavior of existing APIs, such that it has potentially high risk for Android WebView-based applications?

N/A - Web Share API is not enabled in WebView.

Debuggability

No DevTools changes needed.

Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?

No

The Permissions Policy will be supported on all platforms that support Web Share API. Currently, this is Android, Chrome OS, Windows.

Is this feature fully tested by web-platform-tests?

Yes

Flag name

Requires code in //chrome?

False

Tracking bug

https://bugs.chromium.org/p/chromium/issues/detail?id=1079104

Sample links

https://scrawny-bottlenose-somersault.glitch.me/share-from-iframes.html

Estimated milestones
M110

Anticipated spec changes

-

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/6362499966304256

This intent message was generated by Chrome Platform Status.

[Yoav Weiss]

LGTM1

Thanks for catching us up here! :)

On Thu, Nov 17, 2022 at 11:18 PM Eric Willigers <ericwi...@chromium.org> wrote:

Contact emails

ericwi...@chromium.org, fin...@chromium.org

Explainer

https://github.com/w3c/web-share/blob/master/docs/explainer.md

Specification

https://w3c.github.io/web-share/#permissions-policy

Summary

A new permission policy, "web-share", controls access to navigator.share().

The default allowlist is 'self', avoiding possible abuse by third party iframes.

Link to blink-dev discussion

https://groups.google.com/a/chromium.org/g/blink-dev/c/fgme9KOd8CU/m/TCYPKQAXAwAJ

Blink component
Blink>WebShare

TAG review

Not needed, trivial change to existing spec

A better reasoning would be that we're aligning to shipped behavior in other engines.

 

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/e4303ef1-c709-4f90-b97b-e2fc4b0f2e2bn%40chromium.org.

[Mike Taylor]

LGTM2. I think we should expect some compat issues with this change, but they're currently the ones experienced by Safari and Firefox:

https://github.com/jsbin/jsbin/issues/3485

https://github.com/webcompat/web-bugs/issues/105859

https://bugzilla.mozilla.org/show_bug.cgi?id=1737541 (see bugs in "See also")

Do we have any plans to make the developer community aware of the need to delegate web-share permission to iframes now? Maybe a blog post in the works?

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAL5BFfV%3DC7ac0_gk89v7sG8X3kyOSxN%3DFH0i2DpCQ2iYrweDzw%40mail.gmail.com.

[Mike West]

LGTM3.

-mike

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/e4303ef1-c709-4f90-b97b-e2fc4b0f2e2bn%40chromium.org.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

[Marcos Caceres]

Hi Blink-Dev friends,

 

Over on the WebKit side we published a PSA for developers about the permission policy change:

https://webkit.org/blog/13708/allowing-web-share-on-third-party-sites/

As this change affects all browsers and quite a few sites, it would be amazing if folks doing developer relations on the Blink side could help spread the word through your dev channels.

Thanks in advance! 🙏

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/e4303ef1-c709-4f90-b97b-e2fc4b0f2e2bn%40chromium.org.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

[Thomas Steiner]

Thanks, Marcos. I’ll take care on the Chrome side. 

Cheers,

Tom

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/47dca6e7-ba39-4222-9c21-723fa372bd3dn%40chromium.org.

--

Thomas Steiner, PhD—Developer Relations Engineer (https://blog.tomayac.com, https://twitter.com/tomayac)

Google Germany GmbH, ABC-Str. 19, 20354 Hamburg, Germany
Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891

----- BEGIN PGP SIGNATURE -----

Version: GnuPG v2.3.4 (GNU/Linux)

iFy0uwAntT0bE3xtRa5AfeCheCkthAtTh3reSabiGbl0ck0fjumBl3DCharaCTersAttH3b0ttom.hTtPs://xKcd.cOm/1181/

----- END PGP SIGNATURE -----

[Thomas Steiner]

On Wed, Feb 1, 2023 at 6:15 PM Thomas Steiner <to...@google.com> wrote:

Thanks, Marcos. I’ll take care on the Chrome side. 

Here's the PR: https://github.com/GoogleChrome/web.dev/pull/9494. I will also get an additional quick blog post out.

Cheers,

Tom

[Thomas Steiner]

Aaaaand the full announcement blog post PR is merged, too: https://github.com/GoogleChrome/developer.chrome.com/pull/5143. We're all covered.

(In case you're wondering: the post is on developer.chrome.com and not on web.dev (as the original Web Share post) because the WebKit change is in TP, but not in a released version yet.)