RE: ISSUE-187 - What is the right approach to exception handling & ISSUE-185

David,

 

I think the new API is fine for site-specific exceptions, because we are
putting the responsibility to get user agreement on sites where it is
legally anyway.

 

The sentence in 6.4.1 (The execution of this API and the use of the
resulting permission (if granted) use the 'implicit' parameter, when the API
is called, the document origin. This forms the first part of the duplet in
the logical model, and hence in operation will be compared with the
top-level origin) makes it clear that only script in the context of the
top-level origin can register a UGE for the site. If script in third-party
embedded iframe makes a SS UGE call, the implicit document origin points to
the third-party domain so the exception applies there and not at the parent
window's origin.

 

Unfortunately this is not true for the web-wide API so it is possible that
script inside a child iframe could register an exception, which may not
reflect a user's intention. 

 

If we decide to keep web-wide exceptions under the new UI-less regime it
would be safer to limit them to script in the context of top-level origin,
which effectively is the situation for site-specific exceptions. I suggest
we put a sentence like the following into 6.5.1 (and similar in 6.5.2),

 

The web-wide exception is only granted if the document origin host of the
calling script is the same as the top-level origin host.

 

 

Mike