Re: [whatwg/fullscreen] Internal iframe fullscreen event missing? (#179)

A few notes about user activation propagation/visibility, fyi @upsuper:

> I believe it's simply because user gesture is not tracked through postMessage at all, and thus a handler of message event is not considered initiated from a user gesture even if the corresponding message was posted by one. The same was an issue for many other cases including resolving Promise, setTimeout, etc. I'm not sure whether it's possible to allow that, and what other restrictions we would need to avoid abusing it.

The new user activation model in [the HTML spec](https://html.spec.whatwg.org/multipage/interaction.html#tracking-user-activation) eliminated this kind of tracking, through `Window`-wide states.  So `Promise`, `setTimeout`, `postMessage` etc works without any tracking.  Chrome shipped this early last year.

> ... probably being able to recognize user gesture / user activation across <iframe> boundary would be the right direction moving forward.

The new model precisely defines user activation visibility across frame boundaries: visible in parent from any child and not the the other way around.  This visibility was chosen deliberately to prevent abusive calls from cross-origin frames.  For example, it would be terrible if an ad frame can suddenly go fullscreen when the user interacted only with the main frame.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fullscreen/issues/179#issuecomment-677721777