Need concept of "consuming" user activation

[csharrison]

This is related to https://html.spec.whatwg.org/multipage/interaction.html#activation

For algorithms that require triggering via user activation, Chrome has a notion of "consuming" that activation, meaning subsequent events will not be triggered by user activation until a new isTrusted click, etc. event is received. The reasoning behind this is generally to avoid abusive behavior e.g. a site clickjacking the user and spawning N popups instead of just one.

This general concept is required for two recent Blink intents:

1. Initiating main frame navigations consumes a user gesture
2. Simple User Activation

However, it appears that neither Firefox nor Safari use this concept generally, and allow multiple popups to be spawned from a single user gesture. See #1903 (comment)

Mustaq's work with Simple User Activation is Chrome's attempt to spec user activation as a whole, but it might make sense to start a conversation on the "consuming" part at least and what it means.

[domenic]

This is effectively a duplicate of #1903, where Mustaq is already involved. I don't think it's worth introducing a Chromium-specific consumption concept to the spec if the eventual medium-term plan (in Chromium and elsewhere) is to drastically change the architecture.

As such, I'll close this, but am happy to reopen if you think it is somehow a separate issue.

[csharrison]

Sure I don't mind merging the issues, but doesn't the "drastically changed architecture" rely heavily on consumable user activation? I agree we shouldn't just spec Chromium's current behavior.

[domenic]

Yeah, it does, which is why I thought it'd make sense to have the discussion in #1903, where such a change is already being proposed (as part of a larger change which in general has the goal of achieving interop).

Stated another way, I don't see a path forward for addressing this issue without addressing #1903 at the same time. But maybe you do, and that's why you opened it?

[annevk]

Note that I asked for this to be opened as a distinct issue, since the other issue covers quite a bit of ground, including setTimeout() propagation and such. Though maybe that would all end up being unnecessary?

If so, apologies @csharrison.