こんにちは TAG-さん!

I'm requesting a TAG review of Controlled Frame.

The Controlled Frame API exposes a new <controlledframe> tag to Isolated Web Apps that can be used to embed any content, and provides more control over embedded content than other embedding methods like <iframe>, including the power to override opt-out mechanisms like X-Frame-Options and CSP. It is based on the Chrome App WebView API, and provides similar functionality as native WebView APIs such as script injection and network request interception and modification. Due to the level of control this gives a parent frame over embedded content, a different storage partition is used to avoid leaking private data from the user’s normal browsing context. Because of how powerful this API is, it is only exposed to Isolated Web Apps, never to content on normal web pages.

• Explainer: https://github.com/WICG/controlled-frame
• Specification: https://wicg.github.io/controlled-frame/
• WPT Tests: N/A
  • There are Chromium-specific WPT-like tests that we’ll move to Chromium’s wpt_internal directory once our infrastructure supports running WPTs within Isolated Web Apps.
• User research:
• Security and Privacy self-review: https://github.com/WICG/controlled-frame/blob/main/SecurityPrivacyQuestionnaire.md
• GitHub repo: https://github.com/WICG/controlled-frame
• Primary contacts:
  • Robbie McElrath (@robbiemc), Google, editor
  • Andrew Rayskiy (@grapegreen), Google
• Organization/project driving the specification: Google
• Multi-stakeholder support:
  • Mozilla comments: N/A
  • WebKit comments: N/A
  • This API only makes sense within the context of an environment like Isolated Web Apps. The standards position for that proposal was negative from Mozilla, and no response from WebKit. Without the IWA context, we wouldn’t recommend supporting an API like this.
• Status/issue trackers for implementations: https://chromestatus.com/feature/5199572022853632

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• Previous early design review, if any: N/A
• Relevant time constraints or deadlines: None
• The group where the work on this specification is currently being done: WICG
• The group where standardization of this work is intended to be done (if different from the current group): WICG
• Major unresolved issues with or opposition to this specification: Some functionality is only covered by high-level normative text. More details for these sections are currently being written.
• This work is being funded by: Google