search

WICG / document-policy

https://wicg.github.io/document-policy/
Other
19 stars 8 forks source link

Disabling JavaScript #25

Open NickColley opened 4 years ago

NickColley commented 4 years ago

Hello,

We're interested in this work and wondering if it'll be possible to disable JavaScript.

We have some examples in iframes within our GOV.UK Design System website that it would be useful to be able to prevent JavaScript from running conditionally.

https://design-system.service.gov.uk/patterns/addresses/

We'd also find it useful to do this so we can test our progressive enhancement approach and finally it might also be useful for performance reasons.

For example if we had this we could easily show the difference between a component when it's run with JavaScript and without.

craigfrancis commented 4 years ago

I think I would like this as well, but how would this be different from:

Content-Security-Policy: script-src 'none';
mozfreddyb commented 4 years ago

…or Content-Security-Policy: 'sandbox'

clelland commented 4 years ago

The best reason for supporting something like this is the disable-everything-by-default nature of sandbox. It would be about equivalent to

Content-Security-Policy: sandbox allow-same-origin allow-top-navigation
    allow-forms allow-popups allow-pointer-lock allow-modals
    allow-popups-to-escape-sandbox allow-orientation-lock allow-presentation
    allow-top-navigation-by-user-activation allow-storage-access-by-user-activation
    allow-downloads

(Basically every sandbox directive except allow-scripts)

There was a plan to support all of the sandbox attributes with feature policy, and eventually be able to replace sandbox with FP, or make it a shortand for a set of "sandbox best practies", but there are a couple of issues -- the biggest one being that the behaviour in popups is very different between permission-based features and sandbox features.

What I would love to do, and have been spending a lot of time thinking about, is to add sandbox directives to Document Policy. It was designed with that use case in mind, and would probably be a better fit.

In that case, you could disable scripting for a single document with

Document-Policy: no-scripts

Or you could also disable it for every site embedded within that document as well, with

Require-Document-Policy: no-scripts

That would be equivalent to just adding the single sandbox flag, without having to add sandbox and then remove them individually.