search

camillelamy / explainers

11 stars 5 forks source link

Anonymous iframe: credentials attribute #20

Closed antosart closed 3 years ago

antosart commented 3 years ago

What is the semantic of the credentials attribute? credentials=omit vs credentials=present doesn't look good because of inconsistency (omit is a verb, while present is an adjective). In case, I'd suggest having credentials=use instead.

However, I am a bit unhappy with credentials=omit since this is misleading. Credentials are partitioned, not omitted. Moreover, I don't see the point of having a non-boolean attribute for something that can only be set and not unset (credentials=use - if we go with it - has no point of existing, apart from giving a value to be returned by the getter, since a subframe of an anonymous iframe is always anonymous and this cannot be overwritten).

I would reconsider having a boolean attribute instead, something like <iframe anonymous> or <iframe partitioned> or <iframe isolated> or <iframe partitioned-storage> or <iframe clean-credentials> (I fear none of these is a particularly good choice though).

ArthurSonzogni commented 3 years ago

Explainer updated from:

<iframe credentials=omit>

toward

<iframe anonymous>

in PR: https://github.com/ArthurSonzogni/explainers/commit/5d12c9aeb8481736f16fcc91875816afbcece6d4

So we can close this, I guess, once it is merged.

ArthurSonzogni commented 3 years ago

@camillelamy: can we close this?

camillelamy commented 3 years ago

Done.