w3c / webappsec

Web Application Security Working Group repo
https://www.w3.org/groups/wg/webappsec/
Other
605 stars 148 forks source link

[charter 2021] Widen scope of Permission API #579

Closed marcoscaceres closed 3 years ago

marcoscaceres commented 3 years ago

We are looking at expanding the scope of Permissions API to have opinions about UI, lifetimes, etc. so the text is overly restrictive.

mikewest commented 3 years ago

Exciting. Are there sketches of these plans anywhere to skim through? I'm certainly not opposed to doing more work in this area; it's important.

/cc @clelland, @engedy, and @dveditz

marcoscaceres commented 3 years ago

Good starting point https://github.com/w3c/geolocation-api/issues/69#issuecomment-805388266

And issue: https://github.com/w3c/permissions/issues/233

If we agree to widen the scope I'll start drafting up some ideas.

clelland commented 3 years ago

I would love to see the permissions policy features covered by this spec in some way, which could influence the text around UI and lifetimes, but I'm excited to see what comes out of this.

marcoscaceres commented 3 years ago

Ok, so, my rough idea is start with adding a section that broadly describes lifetimes or whatever we like.

Then, in the Permissions Registry, we add something like:

Optional UI requirements:

So, if there are requirements, they can be individually added for each permission as needed (same as other things in the spec).

Then, for example, in the Geolocation Permission we would add something like:

The UI requirements for the Geolocation Permission are as follows: .... [=lifetime=] MUST something something....

samuelweiler commented 3 years ago

I support removing the limit on the scope; we can keep discussing what to actually do in the doc.