Re: [w3c/clipboard-apis] Don't recommend user gesture in clipboard API (#75)

> > But I'm wondering, couldn't your application use an [async](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/async_function) event handler and [wait](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/await) for the result in there?
> 
> Partially answering my own question: with Safari one might run into the limitation mentioned in https://bugs.webkit.org/show_bug.cgi?id=222262.
> 
> However, from a security and privacy perspective, I don't understand that limitation. @whsieh, can you please shed some light on that?

The immediate explanation for this limitation is that we use the same `UserGestureIndicator` check here that we use in other places that require user activation (such as showing UI for file pickers). This means that the user gesture indicator should be propagated through `setTimeout` and fetch requests, for up to 1 second, but _otherwise_ only persists during the scope of handling a user activation event (e.g. `click` or `touchstart`/`touchend`).

I think we could probably relax this constraint, such that the "user interaction" is valid as long as:
1. We handled a user activation event recently (probably, at most ~1 sec. ago?).
2. The browser tab hasn't been backgrounded.
3. Nothing else has attempted to write to the clipboard in the meantime.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/clipboard-apis/issues/75#issuecomment-1088825400
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/clipboard-apis/issues/75/1088825400@github.com>