Re: [battery] Allow use from within secure context and top-level browsing context only

If we add a directive for battery to the feature policy (which is, as @RByers says, pretty simple to do), I think that the sensible default would be to allow use at the top level, *and in any same-origin children*, and block use in cross origin frames.

That's the stance I'm trying to advocate for new policy-controlled APIs, and we're reframing older ones to work the same way. There's really no point in trying to restrict access from same-origin frames, when they can just reach back up through `parent` to do anything they want anyway.

-- 
GitHub Notification of comment by clelland
Please view or discuss this issue at https://github.com/w3c/battery/issues/10#issuecomment-324661401 using your GitHub account

Received on Thursday, 24 August 2017 15:00:37 UTC