{"action":"created","issue":{"url":"https://api.github.com/repos/WICG/feature-policy/issues/38","repository_url":"https://api.github.com/repos/WICG/feature-policy","labels_url":"https://api.github.com/repos/WICG/feature-policy/issues/38/labels{/name}","comments_url":"https://api.github.com/repos/WICG/feature-policy/issues/38/comments","events_url":"https://api.github.com/repos/WICG/feature-policy/issues/38/events","html_url":"https://github.com/WICG/feature-policy/issues/38","id":184141768,"number":38,"title":"How should iframe navigations work?","user":{"login":"raymeskhoury","id":8130584,"avatar_url":"https://avatars.githubusercontent.com/u/8130584?v=3","gravatar_id":"","url":"https://api.github.com/users/raymeskhoury","html_url":"https://github.com/raymeskhoury","followers_url":"https://api.github.com/users/raymeskhoury/followers","following_url":"https://api.github.com/users/raymeskhoury/following{/other_user}","gists_url":"https://api.github.com/users/raymeskhoury/gists{/gist_id}","starred_url":"https://api.github.com/users/raymeskhoury/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raymeskhoury/subscriptions","organizations_url":"https://api.github.com/users/raymeskhoury/orgs","repos_url":"https://api.github.com/users/raymeskhoury/repos","events_url":"https://api.github.com/users/raymeskhoury/events{/privacy}","received_events_url":"https://api.github.com/users/raymeskhoury/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2016-10-20T05:58:40Z","updated_at":"2016-11-09T03:04:45Z","closed_at":null,"body":"What should we do in the case where an iframe navigates itself to an origin other than the one it is initialized to?\n\nOne case to consider here is, the embedder says enable=\"geolocation\" for an iframe initialized to \"good-site.com\" but then the iframe is navigated to \"bad-site.com\". We don't want geolocation to be enabled.\n\nA potential solution is to ignore enable attributes after a cross-origin navigation has occurred, unless the enable attribute is modified and then the iframe reloaded.\n\nWe also need to take care to apply the parent frames header policy correctly when an iframe is navigated to a new origin.\n\n@clelland @mikewest @igrigorik @ojanvafai \n"},"comment":{"url":"https://api.github.com/repos/WICG/feature-policy/issues/comments/259324080","html_url":"https://github.com/WICG/feature-policy/issues/38#issuecomment-259324080","issue_url":"https://api.github.com/repos/WICG/feature-policy/issues/38","id":259324080,"user":{"login":"igrigorik","id":10652,"avatar_url":"https://avatars.githubusercontent.com/u/10652?v=3","gravatar_id":"","url":"https://api.github.com/users/igrigorik","html_url":"https://github.com/igrigorik","followers_url":"https://api.github.com/users/igrigorik/followers","following_url":"https://api.github.com/users/igrigorik/following{/other_user}","gists_url":"https://api.github.com/users/igrigorik/gists{/gist_id}","starred_url":"https://api.github.com/users/igrigorik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/igrigorik/subscriptions","organizations_url":"https://api.github.com/users/igrigorik/orgs","repos_url":"https://api.github.com/users/igrigorik/repos","events_url":"https://api.github.com/users/igrigorik/events{/privacy}","received_events_url":"https://api.github.com/users/igrigorik/received_events","type":"User","site_admin":false},"created_at":"2016-11-09T03:04:45Z","updated_at":"2016-11-09T03:04:45Z","body":"Discussed on VC today, the proposal is: \r\n\r\n```\r\n<iframe href=foo.com featurepolicy='{\"usermedia\": [\"*\"]}'>\r\n<iframe enable=usermedia href=foo.com>\r\n```\r\n\r\nThe former enables \"full policy\" syntax, which also allows the embedder to delegate permission to all origins (e.g. to deal with unknown redirects, etc). The latter (shorthand) `enable` attribute is, on the other hand, simpler and safer in that it implicitly only delegates permission to the origin specified by frame element's `href` attribute value."}}
{"actor":{"display_login":"igrigorik"}}