search

privacycg / storage-access

The Storage Access API
https://privacycg.github.io/storage-access/
199 stars 26 forks source link

Consider building on top of Permissions instead of using the "storage access map" #121

Closed annevk closed 1 year ago

annevk commented 1 year ago

This would allow sharing a bunch of logic around murky concepts such as "user intent".

(There's also some related problems with regards to scope of the grant. Currently the specification uses the agent cluster for this, but there's talk about changing it back to WebKit's original model of document. We should probably track that separately.)

Brandr0id commented 1 year ago

+1, to this. This would also reflect the implementation in Edge/Chromium that leverages the permissions system for managing any prompts as it can leverage other permissions mechanisms for stopping nuisance prompts and holistically seeing if the site(s) in question are also requesting other permissions/prompts.

johannhof commented 1 year ago

As mentioned in #122 I think this is what we should do to reflect the reality in both Firefox and Chrome and also because it fits well onto the per-frame model where the browser maintains an "storage access when requested" permission and a separate "storage access" map on the browsing context. The "storage access when requested" permission could be queried through permissions API or watched through permissionStatus.onchange. This would also solve #55.