search

w3c / mediasession

Media Session API
https://w3c.github.io/mediasession/
Other
129 stars 29 forks source link

Should the default mediasession permission policy value be self instead of * #302

Open youennf opened 1 year ago

youennf commented 1 year ago

Following on https://github.com/w3c/mediasession/pull/299, we probably need to understand how web compatible it is to use 'self' as a default.

marcoscaceres commented 6 months ago

@steimelchrome, is this doable or has this been out for too long?

steimelchrome commented 6 months ago

My gut reaction is that it's been too long at this point, though I don't think Chrome has any metrics for this specific case to know how much would break if we switched

marcoscaceres commented 5 months ago

Are there any pressing security or privacy concerns with leaving it as "*"? I know it's not ideal having that policy, but unless there something pretty serious here, we might just need to let it be.

Are there sufficient mitigations (e.g., audio is muted by default, etc.) that this won't be huge issue in practice?

@youennf, @jan-ivar, or anyone else wdty? Should we let this one go... and did PING by or anyone else (wide review) raise this as a blocker?

If not, we should be prepared to justify the decision to use and keep the "*" policy.

marcoscaceres commented 5 months ago

So, let me ask: can a cross-origin iframe set the media session without user interaction and display something on my lock screen?