Feature Policy: `focus-without-user-activation` #10672

siliu1 · 2024-10-03T17:26:31Z

focus-without-user-activation is a new feature policy that can be used to block programmatic focus changes that are not triggered through user activation (explainer).

The motivation behind this feature policy is to provide better security for websites that embed third party contexts.

This change makes modifications to the following focus API:

autofocus
element.focus(options)
window.focus()

The WHATWG resolved to add a new feature policy, focus-without-user-activation, to control whether third-party iframes can take focus programmatically. (w3c/webappsec-permissions-policy#273 (comment))

The original PR contains all prior discussions regarding the feature policy. However, since I don't have editor access to it, I've created this new PR.

At least two implementers are interested (and none opposed):
- Chromium.
- Gecko: focus-without-user-activation feature policy mozilla/standards-positions#1080
- WebKit: focus-without-user-activation feature policy WebKit/standards-positions#406
Tests are written and can be reviewed and commented upon at:
- wpt/feature-policy/experimental-features/focus-without-user-activation-disabled-tentative.html
- wpt/feature-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html
Implementation bugs are filed:
- Chromium: https://issues.chromium.org/issues/371112534
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=1930537
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=282951
MDN issue is filed: …
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/acknowledgements.html ( diff )
/infrastructure.html ( diff )
/interaction.html ( diff )
/interactive-elements.html ( diff )
/popover.html ( diff )

Cherry-picked from whatwg#4585

… policy is disabled.

zcorpan · 2024-10-16T11:19:17Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

…d `popover focusing steps`

siliu1 · 2024-10-16T16:27:39Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

sanketj · 2024-10-18T05:01:51Z

There are more APIs that call the focusing steps. For example showModal() on dialog. See https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps (click on "focusing steps" to see callers).

This is a good catch. I added extra steps in dialog focusing steps and popover focusing steps to respect the new focus-without-user-activation policy.

There seem to be more APIs than just the above ones that reference "focusing steps".

[#focusing-steps](https://html.spec.whatwg.org/multipage/interaction.html#focusing-steps)

Referenced in:
[2.1.4 DOM trees](https://html.spec.whatwg.org/multipage/infrastructure.html#dom-trees:focusing-steps)
[4.10.20.2 Constraint validation](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#constraint-validation:focusing-steps)
[4.10.20.3 The constraint validation API](https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#the-constraint-validation-api:focusing-steps)
[4.11.3.7 Using the accesskey attribute to define a command on other elements](https://html.spec.whatwg.org/multipage/interactive-elements.html#using-the-accesskey-attribute-to-define-a-command-on-other-elements:focusing-steps)
[4.11.4 The dialog element](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interactive-elements.html#the-dialog-element:focusing-steps-2)
[6.6.2 Data model](https://html.spec.whatwg.org/multipage/interaction.html#data-model:focusing-steps)
[6.6.4 Processing model](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-2) [(3)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-3) [(4)](https://html.spec.whatwg.org/multipage/interaction.html#focus-processing-model:focusing-steps-4)
[6.6.5 Sequential focus navigation](https://html.spec.whatwg.org/multipage/interaction.html#sequential-focus-navigation:focusing-steps)
[6.6.6 Focus management APIs](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/interaction.html#focus-management-apis:focusing-steps-2)
[6.6.7 The autofocus attribute](https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute:focusing-steps)
[6.8.2 Making entire documents editable: the designMode getter and setter](https://html.spec.whatwg.org/multipage/interaction.html#making-entire-documents-editable:-the-designmode-idl-attribute:focusing-steps)
[6.12 The popover attribute](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps) [(2)](https://html.spec.whatwg.org/multipage/popover.html#the-popover-attribute:focusing-steps-2)
[7.2.6.8 Ongoing navigation tracking](https://html.spec.whatwg.org/multipage/nav-history-apis.html#ongoing-navigation-tracking:focusing-steps)
[7.2.6.10.4 Scroll and focus behavior](https://html.spec.whatwg.org/multipage/nav-history-apis.html#navigate-event-scroll-focus:focusing-steps)
[7.4.6.4 Scrolling to a fragment](https://html.spec.whatwg.org/multipage/browsing-the-web.html#scrolling-to-a-fragment:focusing-steps)
[8.1.7.3 Processing model](https://html.spec.whatwg.org/multipage/webappapis.html#event-loop-processing-model:focusing-steps)

Were you able to go through all of them and confirm that the ones you are updating herewith are the only ones that need updates?

sanketj · 2024-10-18T05:08:58Z

At least two implementers are interested (and none opposed):

Chromium.

Gecko: focus-without-user-activation feature policy mozilla/standards-positions#1080

WebKit: focus-without-user-activation feature policy WebKit/standards-positions#406

Tests are written and can be reviewed and commented upon at:

wpt/feature-policy/experimental-features/focus-without-user-activation-disabled-tentative.html

wpt/feature-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html

Implementation bugs are filed:

Chromium: https://issues.chromium.org/issues/371112534

Gecko: TBA

WebKit: TBA

MDN issue is filed: …

The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Could you mark the entries in the checklist that have been completed via [x]? For the ones that are not complete, could you try to complete them? (Ex. filing implementation bugs on Gecko and WebKit)

annevk

This looks reasonable, but it looks like you got in a race with the bot when updating OP. Each time you make an edit (including checking a checkbox) the bot will run. So it's best to click edit and change it all in one go and then wait for the bot to update before making another change.

Though also, if you filed bugs against Gecko/WebKit those need to be linked.

source

annevk

I found some more substantial issues. Please also create an MDN issue.

annevk · 2024-11-15T10:45:08Z

source

@@ -61520,6 +61524,11 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
  are as follows:</p>

  <ol>
+   <li><p>If this algorithm is triggered without <span data-x="transient activation">transient use


I didn't notice this when reading this PR the first time, but this seems wrong. "transient activation" is something you can say about a Window object. So instead of talking about this algorithm, you need to get hold of a window object. Perhaps target's relevant global object?

(This applies multiple times in this PR.)

annevk · 2024-11-15T10:45:30Z

source

@@ -61520,6 +61524,11 @@ interface <dfn interface>HTMLDialogElement</dfn> : <span>HTMLElement</span> {
  are as follows:</p>

  <ol>
+   <li><p>If this algorithm is triggered without <span data-x="transient activation">transient use
+   activation</span> and the <var>target</var> is not <span>allowed to use</span> the "<code


A variable should not have "the" in front of it.

annevk · 2024-11-15T10:47:43Z

source

+   activation</span> and is not triggered by script execution from <var>current</var>'s
+   <span>ancestor navigables</span>, and <var>current</var>'s <span>active document</span> is not


"triggered by script execution" is not a concept that exists or is defined. It's rather unclear to me what this is trying to accomplish.

siliu1 added 6 commits October 1, 2024 10:54

Spec change for focus-without-user-activation

ce00f26

Cherry-picked from whatwg#4585

change default allowlist of user-without-user-activation to self.

8fa69a4

Allow focus delegation in iframe when focus-without-user-activation…

4ba9864

… policy is disabled.

Fix logical error in focus-without-user-activation spec.

8820057

Merge branch 'whatwg:main' into main

9ef05e9

Add Siye Liu to the Thanks to list.

768a15b

siliu1 mentioned this pull request Oct 3, 2024

Feature Policy: focus-without-user-activation #4585

Open

siliu1 added 2 commits October 7, 2024 11:20

Attempt to fix build break.

35661cf

Attempt to fix build break. Also fix logic error.

4eab723

siliu1 marked this pull request as ready for review October 14, 2024 16:11

Add focus-without-user-activation logic to dialog focusing steps an…

bfde2ec

…d `popover focusing steps`

domenic added addition/proposal New features or enhancements topic: focus labels Oct 18, 2024

annevk reviewed Nov 8, 2024

View reviewed changes

source Show resolved Hide resolved

source Show resolved Hide resolved

Fix identation and quote format.

f49ccf5

siliu1 requested a review from annevk November 12, 2024 17:12

annevk reviewed Nov 15, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature Policy: `focus-without-user-activation` #10672

Feature Policy: `focus-without-user-activation` #10672

siliu1 commented Oct 3, 2024 •

edited by pr-preview bot

Loading

zcorpan commented Oct 16, 2024

siliu1 commented Oct 16, 2024

sanketj commented Oct 18, 2024

sanketj commented Oct 18, 2024

annevk left a comment •

edited

Loading

annevk left a comment

annevk Nov 15, 2024

annevk Nov 15, 2024

annevk Nov 15, 2024

		activation</span> and is not triggered by script execution from <var>current</var>'s
		<span>ancestor navigables</span>, and <var>current</var>'s <span>active document</span> is not

Feature Policy: focus-without-user-activation #10672

Are you sure you want to change the base?

Feature Policy: focus-without-user-activation #10672

Conversation

siliu1 commented Oct 3, 2024 • edited by pr-preview bot Loading

zcorpan commented Oct 16, 2024

siliu1 commented Oct 16, 2024

sanketj commented Oct 18, 2024

sanketj commented Oct 18, 2024

annevk left a comment • edited Loading

Choose a reason for hiding this comment

annevk left a comment

Choose a reason for hiding this comment

annevk Nov 15, 2024

Choose a reason for hiding this comment

annevk Nov 15, 2024

Choose a reason for hiding this comment

annevk Nov 15, 2024

Choose a reason for hiding this comment

Feature Policy: `focus-without-user-activation` #10672

Feature Policy: `focus-without-user-activation` #10672

siliu1 commented Oct 3, 2024 •

edited by pr-preview bot

Loading

annevk left a comment •

edited

Loading