Re: [w3ctag/design-reviews] Question: Capability Delegation stalled -- specs are implementing local workarounds (Issue #1213)

RByers left a comment (w3ctag/design-reviews#1213)

I'm not sure this framing is correct. Chromium [shipped](https://chromestatus.com/feature/5708770829139968) capability delegation (everything in that spec I believe) back in 2022, but AFAIK no other implementations have shipped. Unfortunately, I believe the capability delegation spec has tackled only the easy case of delegating capabilities down the frame tree within a single page or from opener to popup window. The issues in PR and DC are about capability delegation across navigations, not about within a page. That's a much harder problem which AFAIK nobody has proposed a solution to.

I'm all for moving capability delegation forward, in Chromium it's proven to provide essential infrastructure for pragmatically mitigating cross-frame abuse without breaking legitimate scenarios. But I think positioning it as the fix for these problems is incorrect. I'll comment more on the payment-specific problem [here](https://github.com/w3c/payment-request/issues/1064).


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1213#issuecomment-4421784145
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1213/4421784145@github.com>