punted

re-reviewing the explainer

Dan: wondering about privacy - what if the user has a private session with the web site in question and also a non-private-browsing-mode session? Can data leak in that case? No mention of private browsing or incognito.

Dan: Generally concerned with any API that deals with history as this can be privacy-impacting.

Lea: it's being prototyped so we could play with the navigation and get first hand experience in using it...

Dan: a little unclear about the impact on the back button user agent UI section of the explainer.

Dan: a little unclear on the joint session history I think the definition needs to be expaned or if it's defined somewhere else then there needs to be a linked.

Peter: history interface on window() - the overall history of the browser.

Dan: but this API is origin bound -

Lea: need to be contiguous as well - only see the history entries from the latest browsing session - which seems reasonable.

Dan: would that address the private browsing mode issue I raised?

Peter: it would create another top level browsing context. Since this is related to the current session on this document it couldn't talk to another session in a private window or vice versa. And if you go from A to B back to A 2nd instance of A can't see earlier entries from A.

Lea: it's a very large API. The basic stuff seems reasonable.

Sangwhan: I looked at this and it looks like a good idea. API looks fine to me.

Lea: it's scoped to a single window. Private browsing is a red herring because even in normal.

Dan: they have answered "no" to the private browsing mode question in S&P questionnaire...

Sangwhan: in some browsers you can re-open a closed private tab - behaviour isn't standardized there.

Lea: in chrome's implementation if you close a tab and re-open it the history is preserved - including in the navigation API.

Dan: is that desirable?

Lea: Yes.

Sangwhan: yes.

Sangwhan: I'm positive - I've used the alternative - push state. and this is an improvemt.

Lea: I'll second that.

Hi Domenic - sorry this took so long.  We've been reviewing and have had the chance to discuss on today's call. Some feedback from that session: In general we're happy with this API. We appreciate the care taken in the security & privacy considations section. One question I had was about how this impacts the behaviour of the back button - it wasn't exactly clear what you mean by "when iframes are involved" here. Can you spell it out a bit more clearly?  Is this to do with the iframe's navigation history being integrated with the parent document's history?  And what is the changed UI you anticipate?  Generally we have positive feedback. This looks like it will be an improvement over the current state of the platform. We're planning to finish the review and close next week.

Dan: posted

Sangwhan: are we happy with this api? I had a followup question. "If the frame is first-party and the content author would like to delegate history down (to the frame) and then back up, how would that work? Obviously this is a bit of an edge case, but mostly asking out of curiousity"

Sangwhan leaves comment and we will try to close at the plenary