#397: Same-Origin iframe document-access limiting attribute
Discussions
2020-05-11
Tess: this got filed mid last year - has not got attention - no comments from me or lukasz. Shall add Ken?
Dan: yes sounds like a good idea to do that, Tess.
[bumped to f2f]
2020-06-08
Tess: Ken had back/forth with the filer over the past few weeks.
Peter: Since Ken's been involved with this so far we should push this over to next week.
2020-06-15
Kenneth: this prevents iframes from getting script access
Kenneth: the naming is weird and there's a separate set of considerations
...: they suggested a number of other names, and i don't like the alternatives
...: though i don't have any suggestions
Dan: definitely don't like DOM Worker
Kenneth: this is only script isolation
Dan: have they been receptive to the comments?
Kenneth: yes, we even got a comment from Domenic explaining how this differs from the other knobs
...: filing iframes so they don't have direct document access
Ken: Dominic suggested disallowdocumentaccess...
Tess: don't dislike "disallowdocumentaccess" name - i have a concern "too many knobs" that tweak too many distinct but related things when it comes to iframes. I worry about the overall cognitive burden on developers. It's not an issue with this proposal - it's a big picture issue. On this specific issue I think they've ended up in a good place, but as the TAG we should step back and do a holistic review of all the ways authors have to tweak iframe capabilities and restrictions - and suggest a way to simplify or consolidate. It could be that there are 2 knobs that are distinct but the use cases could be satisfied by one.
Dan : this is exactly what we should be doing as the TAG. how do we capture this in an issue? Is there anything we could take out of that that could help these people in this case? If not, maybe we should close this off.
Tess: I'll file a design review issue.
Dan : let's propose close and discuss in the plenary
Tess, Kenneth: oka
OpenedJul 29, 2019
こんにちはTAG!
I'm requesting a TAG review of:
Further details:
There is some debate in the one PR about the feasiblity of using feature policy for this definition and I believe it is fine. There is some desire to specify feature policies in meta tags but for this definition it is required to be in a header because it changes the agent cluster (which needs to be determined before the document is created).
We'd prefer the TAG provide feedback as (please select one):