marcoscaceres
commented
2 years ago Sec 2.1; why is "SHOULD NOT" not a "MUST NOT" ? What is the use-case for exposing an API that is not supported? Is there some interoperability issue that I don't understand (quite likely).
I agree. This wording needs to go. No one is exposing .share() without supporting share.
Sec 2.1.2, I like the highly-detailed processing steps; made it easy to follow.
👍
Sec 3, the note about "fire and forget" should be mentioned in 2.1.2 with a pointer here if needed.
Moving the "fire and forget" to 2.1.2. makes sense.
Sec 4. Is there a registry of permission strings (i.e., where "web-share" would appear?) If not, I strongly recommend W3C maintain one.
Good call. It now lives here: https://w3c.github.io/permissions-registry/#registry-table-of-standardized-permissions
Sec 6. I could not think of other security concerns, but note again that I am not an expert in this field. The last bullet leads me to think that the share target should fetch the content and use that for any downstream processing rather than handing off URL's. Is that the intent? Is that a best practice? Should that be made more explicit?
It's application dependent. I'm of the opinion that the guidance as is clear enough. However, I'd be open to specific suggestions.
ericwilligers
richsalz
@samuelweiler asked me to review the document. I am not an expert in this area. I have a few questions/nits and it seems reasonable to merge them into one issue.
Sec 2.1; why is "SHOULD NOT" not a "MUST NOT" ? What is the use-case for exposing an API that is not supported? Is there some interoperability issue that I don't understand (quite likely).
Sec 2.1.2, I like the highly-detailed processing steps; made it easy to follow.
Sec 3, the note about "fire and forget" should be mentioned in 2.1.2 with a pointer here if needed.
Sec 4. Is there a registry of permission strings (i.e., where "web-share" would appear?) If not, I strongly recommend W3C maintain one.
Sec 6. I could not think of other security concerns, but note again that I am not an expert in this field. The last bullet leads me to think that the share target should fetch the content and use that for any downstream processing rather than handing off URL's. Is that the intent? Is that a best practice? Should that be made more explicit?