From d66f5730dfbdc990e1738eaf62c987d1da48c253 Mon Sep 17 00:00:00 2001 From: Mustaq Ahmed Date: Mon, 10 Jan 2022 10:37:22 -0500 Subject: [PATCH] Clarify consumption of user activation at the initiation step. --- spec.bs | 26 ++++++++++++++++++-------- spec.html | 43 ++++++++++++++++++++++++++++--------------- 2 files changed, 46 insertions(+), 23 deletions(-) diff --git a/spec.bs b/spec.bs index a869acd..31c9e47 100644 --- a/spec.bs +++ b/spec.bs @@ -68,13 +68,23 @@ capability delegation in future. ## Transient availability ## {#transient-availability} -Both the steps mentioned above are time-constrained in nature. The initiation -step is [[html#user-activation-gated-apis|activation consuming]], so the step is -allowed only after a recent user activation. After successful completion of -this step, the delegated API becomes available for use for a few seconds (to be -precise, the same limit as [activation -expiry](https://html.spec.whatwg.org/multipage/interaction.html#activation-expiry) -unless the limit is defined otherwise by the specification of the delegated API. +Both the steps mentioned above are time-constrained in nature: + +1. The initiation step is [[html#user-activation-gated-apis|activation + consuming]], so the step is allowed only after a recent user activation. + Moreover, the consumption of user activation here guarantees that the + delegation mechanism can't be used more than once per user activation. This + prevents malicous uses of capability delegation, like repeated delegation + attempts to multiple frames to effectively bypass the user activation + restriction for the delegated API. + +2. After a successful completion of the initiation step, the delegated API + becomes available for use in the target [=browsing context=] for a few + seconds only. The exact time limit here depends on how a delegated API + defines the delegated behavior in its own specification. For an API that + does not define its own time limit, the default limit will be the same as + [user activation + expiry](https://html.spec.whatwg.org/multipage/interaction.html#activation-expiry). # Examples # {#examples} @@ -145,7 +155,7 @@ will be followed by two additional steps as follows: 8. If delegate is not null, then: - 1. If targetOrigin is a single U+002A ASTERISK character (*), then throw a + 1. If targetOrigin is a single U+002A ASTERISK character (*), then throw a a "NotAllowedError" DOMException. 2. If targetWindow has [transient diff --git a/spec.html b/spec.html index a442b50..c87c00b 100644 --- a/spec.html +++ b/spec.html @@ -6,7 +6,7 @@ - +