[w3c/push-api] Browser MUST always display a permission prompt after a user interaction (Issue #356)

I would like to report an "abusive" behavior of some versions of Chrome on mobile.

A few years ago it was said that displaying a "permission prompt" directly on page load is not a good practice.

The recommended solution - even in Google UX guides - was to explain to the user the purpose of the notifications using HTML, CSS and then if the user explicitly clicks "Subscribe" then show the actual permission prompt.

Now I have seen on a specific version of Chrome on mobile that Chrome automatically blocks the notifications even on a website that has always respected the UX requirements (e.g. [double permission prompt](https://blog.pushpad.xyz/2020/04/the-double-opt-in-for-web-push-notifications/)).

This is what happens:

1. The user wants to subscribe to the notifications and clicks "Allow" on the first prompt (designed with HTML + CSS)
2. The user should now see the actual permission prompt to confirm the choice... but Chrome automatically blocks the notifications without asking to the user.

This is a terrible user experience and makes it really hard for a user to subscribe to the notifications, even on legit websites that follows the best practices.

Please clarify in the standard that **a browser MUST display the permission prompt after an explicit user interaction** (e.g. click on a button).

Note: you can reproduce the described behavior on the latest versions of Chrome on mobile on https://blog.pushpad.xyz for example.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/356
You are receiving this because you are subscribed to this thread.

Message ID: <w3c/push-api/issues/356@github.com>