Re: [mediacapture-screen-share] Should top-level transient activation be sufficient for `getDisplayMedia()` on cross-origin iframes with allow="display-capture"? (#167)

Let me clarify last few posts here, we are linking two different proposals here:

- @karlt is correct about [JS API for querying User Activation](https://github.com/dtapuska/useractivation) which allows a frame to only "see" the user activation state of another frame.

- The issue @annevk linked (whatwg/html#4364) was delegating user activation  through `postMessage()` calls.  This issue can be considered dead now---TAG expressed valid concerns around abusability.  We are exploring an alternate proposal ([Capability Delegation](https://docs.google.com/document/d/1lx7qO7mFPhQwq0HkiL19d-rwKAEz3T3FnT9Gh6WRLmY/edit?usp=sharing)) which focuses on API-specific delegation without modifying user activation state in any frame.  If media-capture finds this useful, please let us know.

For the media-capture question raised in this issue, I think the answer depends on what `allow="display-capture"` really means.  Does it expect the subframe to rely on its _own_ user activation for a media-capture call or no?  An "yes" seems to be the safest answer to me because, for example, I don't ever want a random ad subframe in a site to perform screen-capture without a click in that frame.


-- 
GitHub Notification of comment by mustaqahmed
Please view or discuss this issue at https://github.com/w3c/mediacapture-screen-share/issues/167#issuecomment-821259898 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 16 April 2021 15:33:44 UTC