Intent to prototype & ship: Fullscreen Keyboard Lock API

[Adam Vandolder]

Intent to prototype & ship: Fullscreen Keyboard Lock API

Summary:

The Fullscreen Keyboard Lock API adds an optional argument to requestFullscreen that allows websites to request that while they are in fullscreen, pressing the Escape key no longer exits fullscreen (instead a long-press is required), and certain formerly-reserved browser hotkeys are allowed to be default-prevented.

Bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=700123

Bug to turn on by default:

https://bugzilla.mozilla.org/show_bug.cgi?id=2032302

Specification:

https://github.com/whatwg/fullscreen/pull/232

Standards Body:

WHATWG, as part of the Fullscreen API Standard

Platform Coverage:

Desktop only

Preference:

dom.fullscreen.keyboard_lock.enabled

DevTools Bug:

N/A

Extensions Bug:

N/A

Use Counter:

Tracked in Bug 2032749 - Add use counter for Fullscreen keyboard lock API

Standards-Positions Discussion:

https://github.com/mozilla/standards-positions/issues/1385

Other Browsers:

-Blink: shipped a different API since version 68, but we're negative on that API

-WebKit: Shipped since version 26.4

web-platform-tests:

WPTs added in https://github.com/web-platform-tests/wpt/pull/59275

Gecko-only tests have been added as well, as not all behaviour in the implementation is standardized - for instance, what browser shortcuts should be disabled, or the warning UI state.

Web Designer / Developer Use-Cases:

A driving design concern was that of browser-based video games. Many games make use of the Escape key, as well as key combinations that are common browser hotkeys - for instance, having CTRL+W be “walk forward while crouching” is found in many popular games, and is also the shortcut for closing a tab. Rebinding these keys may not be possible or ergonomic, so the Fullscreen Keyboard Lock API provides a way around this.

Security & Privacy Concerns:

In order to ensure the user can figure out how to exit fullscreen, we will show a warning UI when Escape is rapidly triple-clicked or when Escape is long pressed, telling the user to press & hold instead. Also, browser hotkeys which allow exiting fullscreen (such as F11 or cmd+ctrl+f on Mac) are never allowed to be default-prevented.

There are some differences between the API we have implemented and that shipped in Safari; specifically, Safari requires the Escape key to be default-prevented by the website in order for the keyboard lock to block it, and we do not. Also, with the keyboard lock enabled, we prevent a single Escape press from exiting pointerlock, instead tying it to the long-press; Safari has not implemented this.