Closed domenic closed 2 years ago
@chrishtr suggests that maybe the Esc key in general should not count as user activation, which would indeed solve this problem. For example, visiting a page, and doing nothing but pressing Esc, should maybe not give that page license to show a popup, or play unmuted video.
This is pretty interesting and probably deserves wider discussion with the HTML community. I will add a comment at https://github.com/whatwg/html/issues/3849.
I agree with @domenic's proposal here, and this should be discussed in whatwg/html#3849.
(Reposting from that HTML issue: Chrome stopped counting Esc key as a user activation a while ago.)
This seems to be being taken care of on the HTML side, so we are good to go: https://github.com/whatwg/html/pull/7248. Thanks @mustaqahmed for doing that work!
When coding up the current spec/explainer draft, I realized that the Esc key counts as user activation. This means that on desktop, all the fancy abuse prevention mechanisms for the
cancel
event do nothing: since pressing Esc means there is always recent user activation, thecancel
event will always fire (and can bepreventDefault()
ed).On the one hand: that seems fine! On desktop we don't have to worry about back trapping, and we can already
preventDefault()
the Esckeydown
event. No issues; this makes the API easier to use on desktop as you don't have to worry so much about user activation!On the other hand: this is a weird divergence between desktop and Android (or desktop and other platforms where the close signal is not a user activation), and makes code harder to test. So maybe we should spec it so that an Esc keypress (or other user action) that sends a close signal, never counts as user activation, regardless of the platform.