Open xyaoinum opened 1 year ago
IIUC, for request for ClientHint, it is using the outermost frame's document, rather than the iframe's container document. Besides, ClientHints seems to compute the origin by applying the ongoing sandbox flags (so it can be opaque), rather than the URL's origin. Should we consider ClientHint as an exception?</p> <p>Nevertheless, I think the spec should provide some guidance/examples on how the "<a rel="noreferrer nofollow" target="_blank" href="https://w3c.github.io/webappsec-permissions-policy/#algo-should-request-be-allowed-to-use-feature">Should request be allowed to use feature?</a>" algorithm is supposed to be used in different scenarios. For example, is this algorithm applicable to fetch() request, as well as the <iframe src=…> navigation request? (A related issue: for navigation request, it's unclear whether/when the request's window is actually set: <a rel="noreferrer nofollow" target="_blank" href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-request">https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-request</a>)</p> </div> </div> <div class="page-bar-simple"> </div> <div class="footer"> <ul class="body"> <li>© <script> document.write(new Date().getFullYear()) </script> Githubissues.</li> <li>Githubissues is a development platform for aggregating issues.</li> </ul> </div> <script src="https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.min.js"></script> <script src="/githubissues/assets/js.js"></script> <script src="/githubissues/assets/markdown.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js"></script> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/languages/go.min.js"></script> <script> hljs.highlightAll(); </script> </body> </html>
IIUC, for