[whatwg/fullscreen] Ending fullscreen for popups (#116)

In #93, a general clause was added that the user agent could unilaterally decide to end fullscreen if it deemed it in the best interests of the user. In that issue, @domenic wrote:

>We could go a step further though and also try to get cross-browser agreement on specific points at which you fully exit fullscreen

I'd like to change the spec to align browsers in the case of popups vs fullscreen.

❦❦❦❦❦❦

Fullscreen is an immersive environment and, towards achieving that immersion, removes window chrome. Popups are a feature that allow one page to open another, and thus inherently relies on the windowing system with its accompanying window chrome. The concepts of fullscreen and popups are incompatible. In addition, the Chromium security team has seen attacks to subvert our fullscreen security UI using popups.

There are two questions here. What should happen when...
1. A page opens a popup while in fullscreen?
1. A page focuses a popup while in fullscreen?

Current browser behavior:
**Chrome**
1. If a page is in fullscreen, opening a popup kicks it out of fullscreen.
1. If a page is in fullscreen, attempting to focus a popup...
   - _Mac_: switches screens to the popup as the fullscreen uses the native fullscreen (thus accidentally avoiding a security bug I'm working on)
   - _Other_: places the popup on top of the fullscreen (this is the security bug I'm working on)

**Firefox**
1. If a page is in fullscreen, opening a popup kicks it out of fullscreen.
1. If a page is in fullscreen, attempting to focus a popup places the popup on top of the fullscreen (which actually is exactly the same security bug as Chrome has)

**Safari**
1. If a page is in fullscreen, opening a popup makes the popup go fullscreen replacing the existing fullscreen page.
1. If a page is in fullscreen, attempting to focus a popup switches screens to the popup as the fullscreen uses the native fullscreen.

**Edge**
1. If a page is in fullscreen, opening a popup kicks it out of fullscreen.
1. If a page is in fullscreen, attempting to focus a popup kicks it out of fullscreen.

The behavior I'd like to align everyone on is the Edge behavior. I think it's simple to understand: if a fullscreen page plays with popups, it loses fullscreen.

(+ @foolip as one of the blink-dev peeps/fullscreen peeps)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fullscreen/issues/116