Feature Policy: `focus-without-user-activation` #10672

siliu1 · 2024-10-03T17:26:31Z

focus-without-user-activation is a new feature policy that can be used to block programmatic focus changes that are not triggered through user activation (explainer).

The motivation behind this feature policy is to provide better security for websites that embed third party contexts.

This change makes modifications to the following focus API:

autofocus
element.focus(options)
window.focus()

The WHATWG resolved to add a new feature policy, focus-without-user-activation, to control whether third-party iframes can take focus programmatically. (w3c/webappsec-permissions-policy#273 (comment))

The original PR contains all prior discussions regarding the feature policy. However, since I don't have editor access to it, I've created this new PR.

At least two implementers are interested (and none opposed):
- Chromium.
- Gecko: focus-without-user-activation feature policy mozilla/standards-positions#1080
- WebKit: focus-without-user-activation feature policy WebKit/standards-positions#406
Tests are written and can be reviewed and commented upon at:
- wpt/feature-policy/experimental-features/focus-without-user-activation-disabled-tentative.html
- wpt/feature-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/371112534
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1930537
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=282951
MDN issue is filed: Add focus-without-user-activation permissions policy mdn/content#37532
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/acknowledgements.html ( diff )
/infrastructure.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )
/popover.html ( diff )

Cherry-picked from whatwg#4585

… policy is disabled.

zcorpan · 2024-10-16T11:19:17Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

…d `popover focusing steps`

siliu1 · 2024-10-16T16:27:39Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

sanketj · 2024-10-18T05:01:51Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

There seem to be more APIs than just the above ones that reference "focusing steps".

[#focusing-steps](https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps)

Referenced in:
[2.1.4 DOM trees](https://html.spec.whatwg.org/multipage/infrastructure.html#dom-trees:focusing-steps)
[4.10.20.2 Constraint validation](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#constraint-validation:focusing-steps)
[4.10.20.3 The constraint validation API](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#the-constraint-validation-api:focusing-steps)
[4.11.3.7 Using the accesskey attribute to define a command on other elements](https://html.spec.whatwg.org/multipage/interactive-elements.html#using-the-accesskey-attribute-to-define-a-command-on-other-elements:focusing-steps)
[4.11.4 The dialog element](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps-2)
[6.6.2 Data model](https://html.spec.whatwg.org/multipage/interaction.html#data-model:focusing-steps)
[6.6.4 Processing model](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-2) [(3)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-3) [(4)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-4)
[6.6.5 Sequential focus navigation](https://html.spec.whatwg.org/multipage/interaction.html#sequential-focus-navigation:focusing-steps)
[6.6.6 Focus management APIs](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps-2)
[6.6.7 The autofocus attribute](https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute:focusing-steps)
[6.8.2 Making entire documents editable: the designMode getter and setter](https://html.spec.whatwg.org/multipage/interaction.html#making-entire-documents-editable:-the-designmode-idl-attribute:focusing-steps)
[6.12 The popover attribute](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps-2)
[7.2.6.8 Ongoing navigation tracking](https://html.spec.whatwg.org/multipage/nav-history-apis.html#ongoing-navigation-tracking:focusing-steps)
[7.2.6.10.4 Scroll and focus behavior](https://html.spec.whatwg.org/multipage/nav-history-apis.html#navigate-event-scroll-focus:focusing-steps)
[7.4.6.4 Scrolling to a fragment](https://html.spec.whatwg.org/multipage/browsing-the-web.html#scrolling-to-a-fragment:focusing-steps)
[8.1.7.3 Processing model](https://html.spec.whatwg.org/multipage/webappapis.html#event-loop-processing-model:focusing-steps)

Were you able to go through all of them and confirm that the ones you are updating herewith are the only ones that need updates?

sanketj · 2024-10-18T05:08:58Z

At least two implementers are interested (and none opposed):

Chromium.

Gecko: focus-without-user-activation feature policy mozilla/standards-positions#1080

WebKit: focus-without-user-activation feature policy WebKit/standards-positions#406

Tests are written and can be reviewed and commented upon at:

wpt/feature-policy/experimental-features/focus-without-user-activation-disabled-tentative.html

wpt/feature-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html

Implementation bugs are filed:

Chromium: https://issues.chromium.org/issues/371112534

Gecko: TBA

WebKit: TBA

MDN issue is filed: …

The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Could you mark the entries in the checklist that have been completed via [x]? For the ones that are not complete, could you try to complete them? (Ex. filing implementation bugs on Gecko and WebKit)

annevk

This looks reasonable, but it looks like you got in a race with the bot when updating OP. Each time you make an edit (including checking a checkbox) the bot will run. So it's best to click edit and change it all in one go and then wait for the bot to update before making another change.

Though also, if you filed bugs against Gecko/WebKit those need to be linked.

source

annevk

I found some more substantial issues. Please also create an MDN issue.

source

annevk · 2025-01-16T16:01:06Z

source

+   <li><p>If this algorithm is triggered without <span data-x="transient activation">transient use
+   activation</span> in <var>current</var>'s <span>relevant global object</span> and <var>current</var>'s
+   <span>active document</span> is not <span>allowed to use</span> the "<code
+   data-x="focus-without-user-activation-feature">focus-without-user-activation</code>" feature,
+   then return.</p></li>


Where does current come from here? Perhaps you mean the current global object? That won't work if we're also concerned about postMessage() like scenarios, but I don't think we are?

You don't have to say "if this algorithm is triggered". At least I'm not sure what that adds if all you want to do is check state and then return if the state is incorrect.

Fixed in next iteration.

annevk · 2025-01-20T15:13:48Z

source

@@ -61520,6 +61524,12 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
  are as follows:</p>

  <ol>
+   <li><p>If there is no <span data-x="transient activation">transient user activation</span> in


I think this should be worded slightly differently still:

If subject's relevant global object has no transient user activation ...

Are you sure this is the correct global to check though?

annevk · 2025-01-20T15:14:18Z

source

@@ -61520,6 +61524,12 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
  are as follows:</p>

  <ol>
+   <li><p>If there is no <span data-x="transient activation">transient user activation</span> in
+   <var>subject</var>'s <span>relevant global object</span> and <var>subject</var>'s


Presumably this should be OR?

annevk · 2025-01-20T15:16:59Z

source

@@ -80532,6 +80542,13 @@ dictionary <dfn dictionary>ToggleEventInit</dfn> : <span>EventInit</span> {

   <li><p>If <var>current</var> is null, then return.</p></li>

+   <li><p>If there is no <span data-x="transient activation">transient user activation</span> in
+   <var>current</var>'s <span>relevant global object</span> and is not triggered by invoking
+   <code data-x="dom-focus">focus()</code> method on a <span data-x="concept-tree-child">child</span>


This needs to be done differently. We can't rely directly on a public method. That method manipulates some state. That state in turn is something we could rely on.

siliu1 added 6 commits October 1, 2024 10:54

Spec change for focus-without-user-activation

ce00f26

Cherry-picked from whatwg#4585

change default allowlist of user-without-user-activation to self.

8fa69a4

Allow focus delegation in iframe when focus-without-user-activation…

4ba9864

… policy is disabled.

Fix logical error in focus-without-user-activation spec.

8820057

Merge branch 'whatwg:main' into main

9ef05e9

Add Siye Liu to the Thanks to list.

768a15b

siliu1 mentioned this pull request Oct 3, 2024

Feature Policy: focus-without-user-activation #4585

Open

siliu1 added 2 commits October 7, 2024 11:20

Attempt to fix build break.

35661cf

Attempt to fix build break. Also fix logic error.

4eab723

siliu1 marked this pull request as ready for review October 14, 2024 16:11

Add focus-without-user-activation logic to dialog focusing steps an…

bfde2ec

…d `popover focusing steps`

domenic added addition/proposal New features or enhancements topic: focus labels Oct 18, 2024

annevk reviewed Nov 8, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

Fix identation and quote format.

f49ccf5

siliu1 requested a review from annevk November 12, 2024 17:12

annevk reviewed Nov 15, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

source Outdated Show resolved Hide resolved

Address PR comments.

1cdef9a

siliu1 mentioned this pull request Jan 6, 2025

Add focus-without-user-activation permissions policy mdn/content#37532

Open

siliu1 requested a review from annevk January 6, 2025 23:39

annevk reviewed Jan 16, 2025

View reviewed changes

Address PR comments.

22b9553

annevk reviewed Jan 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature Policy: `focus-without-user-activation` #10672

Feature Policy: `focus-without-user-activation` #10672

siliu1 commented Oct 3, 2024 •

edited by pr-preview bot

Loading

zcorpan commented Oct 16, 2024

siliu1 commented Oct 16, 2024

sanketj commented Oct 18, 2024

sanketj commented Oct 18, 2024

annevk left a comment •

edited

Loading

annevk left a comment

annevk Jan 16, 2025

siliu1 Jan 17, 2025

annevk Jan 20, 2025

annevk Jan 20, 2025

annevk Jan 20, 2025

Feature Policy: focus-without-user-activation #10672

Are you sure you want to change the base?

Feature Policy: focus-without-user-activation #10672

Conversation

siliu1 commented Oct 3, 2024 • edited by pr-preview bot Loading

zcorpan commented Oct 16, 2024

siliu1 commented Oct 16, 2024

sanketj commented Oct 18, 2024

sanketj commented Oct 18, 2024

annevk left a comment • edited Loading

Choose a reason for hiding this comment

annevk left a comment

Choose a reason for hiding this comment

annevk Jan 16, 2025

Choose a reason for hiding this comment

siliu1 Jan 17, 2025

Choose a reason for hiding this comment

annevk Jan 20, 2025

Choose a reason for hiding this comment

annevk Jan 20, 2025

Choose a reason for hiding this comment

annevk Jan 20, 2025

Choose a reason for hiding this comment

Feature Policy: `focus-without-user-activation` #10672

Feature Policy: `focus-without-user-activation` #10672

siliu1 commented Oct 3, 2024 •

edited by pr-preview bot

Loading

annevk left a comment •

edited

Loading