Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Policy: downloads-without-user-activation #289

Open
ehsan-karamad opened this issue Mar 26, 2019 · 1 comment
Open

Feature Policy: downloads-without-user-activation #289

ehsan-karamad opened this issue Mar 26, 2019 · 1 comment

Comments

@ehsan-karamad
Copy link
Contributor

There have been several discussions on w3c threads (mainly #213) related to limiting download. This proposal is strictly about introducing a counterpart policy to the sandbox flag: allow-downloads-without-user-activation (proposed here). The proposed feature is in line with implementing sandbox on top of feature policies.

The feature can be set for an inline-frame by modifying the allow attribute. For example:

<iframe allow="downloads-without-user-activation https://foo.com"></iframe>

would enable automatic downloads for any document inside the <iframe> which belongs to https://foo.com origin. Documents from other origins will not be able to initiate a download.

As with all feature policies, the proposed feature can be set in HTTP response headers:

Feature-Policy: downloads-without-user-activation 'self'

would disable automatic downloads in all nested and auxiliary browsing contexts of the main document which are not same-origin.

chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 2, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 4, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 4, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 4, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 4, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 5, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 5, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 8, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 9, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 9, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 12, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 15, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 15, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 15, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 16, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

Bug: 812381
TBR=alexmos@chromium.org
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 17, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this issue Apr 17, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}
imran1008 pushed a commit to bloomberg/chromium.bb that referenced this issue May 21, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}
Former-commit-id: 6099951acbfc1c3257d74aeadc916685cd474fa8
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this issue Jun 5, 2019
…-activation, a=testonly

Automatic update from web-platform-tests
[ FeaturePolicy ] downloads-without-user-activation

The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}

--

wpt-commits: 4b7972b30a143ea14a4b1fb017d69e048e920194
wpt-pr: 16218
mykmelez pushed a commit to mykmelez/gecko that referenced this issue Jun 6, 2019
…-activation, a=testonly

Automatic update from web-platform-tests
[ FeaturePolicy ] downloads-without-user-activation

The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}

--

wpt-commits: 4b7972b30a143ea14a4b1fb017d69e048e920194
wpt-pr: 16218
marcoscaceres pushed a commit to web-platform-tests/wpt that referenced this issue Jul 23, 2019
The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmos@chromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramad@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Commit-Queue: Ehsan Karamad <ekaramad@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651773}
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this issue Oct 4, 2019
…-activation, a=testonly

Automatic update from web-platform-tests
[ FeaturePolicy ] downloads-without-user-activation

The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmoschromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramadchromium.org>
Reviewed-by: Alex Moshchuk <alexmoschromium.org>
Reviewed-by: Ian Clelland <iclellandchromium.org>
Reviewed-by: Kent Tamura <tkentchromium.org>
Reviewed-by: Ken Buchanan <kenrbchromium.org>
Commit-Queue: Ehsan Karamad <ekaramadchromium.org>
Cr-Commit-Position: refs/heads/master{#651773}

--

wpt-commits: 4b7972b30a143ea14a4b1fb017d69e048e920194
wpt-pr: 16218

UltraBlame original commit: 24af4073d267a03e2583bbb35f485b4e60574390
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this issue Oct 4, 2019
…-activation, a=testonly

Automatic update from web-platform-tests
[ FeaturePolicy ] downloads-without-user-activation

The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmoschromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramadchromium.org>
Reviewed-by: Alex Moshchuk <alexmoschromium.org>
Reviewed-by: Ian Clelland <iclellandchromium.org>
Reviewed-by: Kent Tamura <tkentchromium.org>
Reviewed-by: Ken Buchanan <kenrbchromium.org>
Commit-Queue: Ehsan Karamad <ekaramadchromium.org>
Cr-Commit-Position: refs/heads/master{#651773}

--

wpt-commits: 4b7972b30a143ea14a4b1fb017d69e048e920194
wpt-pr: 16218

UltraBlame original commit: 24af4073d267a03e2583bbb35f485b4e60574390
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this issue Oct 4, 2019
…-activation, a=testonly

Automatic update from web-platform-tests
[ FeaturePolicy ] downloads-without-user-activation

The CL implements a new feature policy hidden behind the flag
FeaturePolicyForSandbox. The policy is the feature policy counterpart to
the sandbox flag 'allow-downloads-without-user-activation'. This policy
is used to help migrate sandbox flags implementation on top of feature
policies.

PA: w3c/webappsec-permissions-policy#289

TBR=alexmoschromium.org

Bug: 812381
Change-Id: I234bb0486313ab350827315843db22525c2ceaac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1538966
Reviewed-by: Ehsan Karamad <ekaramadchromium.org>
Reviewed-by: Alex Moshchuk <alexmoschromium.org>
Reviewed-by: Ian Clelland <iclellandchromium.org>
Reviewed-by: Kent Tamura <tkentchromium.org>
Reviewed-by: Ken Buchanan <kenrbchromium.org>
Commit-Queue: Ehsan Karamad <ekaramadchromium.org>
Cr-Commit-Position: refs/heads/master{#651773}

--

wpt-commits: 4b7972b30a143ea14a4b1fb017d69e048e920194
wpt-pr: 16218

UltraBlame original commit: 24af4073d267a03e2583bbb35f485b4e60574390
@MarcWadai
Copy link

Hi, what is the status of this feature policy ? is it still on going or abandoned ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants