[uievents] Add a note to document of default action of KeyboardEvent for allowing UA not to fire key events for some shortcut keys (#65)

Mozilla staff are now discussing "shortcut key handling" vs. "preventDefault() of 'keydown'".

In strictly speaking for current UI Events spec, any native keyboard events should be exposed to web contents and UA shouldn't ignore defaultPrevented attribute value at handling shortcut key.

However, this may cause security issue. If a web page calls preventDefault() for all keydown events, users who can use only keyboard cannot switch active tabs, move focus nor quit from web browser. This means that such can be incarcerated into a web page.

For struggling with this, web browsers already take actions:

Firefox dispatches any keyboard events which is sent from OS but allows users to switch tab with ignoring defaultPrevented attribute.

Similarly, Chrome, Safari and Edge don't dispatch keyboard events which are registered by browser's UI. E.g.,

* Chrome and Safari on Mac:
 * Cmd+N, Cmd+W, Cmd+Q, Cmd+T, Ctrl+Tab, Ctrl+Shift+Tab
* Chrome on Mac
 * Ctrl+PageUp, Ctrl+PageDown
* Safari on Mac:
 * Cmd+R, Cmd+L,Ctrl+Home
* Chrome and Edge on Windows
 * Ctrl+F4
* Chrome on Windows
 * Ctrl+N, Ctrl+W, Ctrl+T, Ctrl+PageDown, Ctrl+PageUp, Ctrl+Tab, Ctrl+Shift+Tab
* Edge on Windows
 * Ctrl+P, Ctrl+Tab, Ctrl+Shift+Tab

So, I think that UI Events spec should explicitly define that browsers MAY fire no keyboard events which are reserved by UI and MAY ignore calls of preventDefault() when the key combination is important for UI.

The section should be:

6.3.5 Default actions and cancelable keyboard events:
https://w3c.github.io/uievents/#keys-cancelable-keys

or

"keydown" (and "keyup"?) event definition:
https://w3c.github.io/uievents/#event-type-keydown

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/uievents/issues/65