Re: [w3c/permissions] Only allow permissions.request() during user interaction (#77)

If a Chrome user grants a permission, it's assumed they want to persist that grant across page reloads, and the only way to make the grant not hold on the next load is to explicitly revoke it.

I understand the proposal as "a page can't cause a permission prompt without a user gesture." If the user has granted persistent access to one camera, the page would be able to start using that camera on page load. It would not be able to request access to another one on page load.

If a user intended to grant permission temporarily, it seems like we should be discouraging pages from bugging them about it until they express interest in re-granting the permission. The premise in Frank's scenario is that he intends to give appear.in access to his camera every time he visits, but he's somehow failed to do it and so is getting bugged each time he visits. Why isn't the right thing for him to do just to grant persistent access?

We could add an extra bit to the permissions that get stored: if the user has ever granted this site permission before, then a new request doesn't require a gesture. If it's the first time, it does require a gesture.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/77#issuecomment-223141143