privacycg / storage-access

The Storage Access API
https://privacycg.github.io/storage-access/
199 stars 26 forks source link

FR: Ability for a frame to indicate on initial load that storage access is required #131

Open lghall opened 1 year ago

lghall commented 1 year ago

At Google Workspace, we have embeds that require authentication on initial load (for example: an embedded document or a calendar appointment booking page).

This request is to expose a way for a frame to automatically request storage access on initial load via a browser-level UI associated with the frame (such as an overlay over the frame), and automatically reload the frame (and ideally other same-site frames on the same page in this state) if access is granted.

annevk commented 1 year ago

I don't think this is something WebKit would be interested in. We want end users to engage with the nested document and have that guide the user around the initial request.

bvandersloot-mozilla commented 1 year ago

Ditto from Mozilla- if the iframe doesn't have permission to get storage access, what should be shown? I think having an interstitial page (same-origin as the intended embedded document) that requests storage-access and redirects to the intended document is a better solution. This request won't even need user interaction if the permission is already set.

johannhof commented 1 year ago

So I think there may be some interesting things we could experiment with to help this request in spirit in the future, such as a dedicated permission element and / or more inline UI for Storage Access, but as it stands it's not high on our list of priorities either. I think I'd be interested in websites' real world experiences regarding the prompt-in-the-corner user experience and engagement rate to get a better sense of how much improvement here is needed.

I think this is still worth keeping around with a "future" label though, we've had a few issues stick around for a while to get eventually resolved (or improved).