Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrictions #363

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Restrictions #363

wants to merge 3 commits into from

Conversation

maxpassion
Copy link

@maxpassion maxpassion commented Mar 22, 2022

@maxpassion maxpassion requested a review from cynthia March 22, 2022 09:22
index.bs Outdated Show resolved Hide resolved
index.bs Outdated Show resolved Hide resolved
@@ -318,6 +318,23 @@ but in some cases the feature should also be detectable
in the language where it is used
(such as ''@supports'' in CSS).

<h3 id="restriction-options">Use appropriate methods for restricting features</h3>

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need actionable principle.

* [Referrer Policy](https://w3c.github.io/webappsec-referrer-policy/)
* [Document Policy](https://w3c.github.io/webappsec-feature-policy/document-policy.html)

TODO: Separate out the ones that are not yet interoperable into their own category.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's not interoperable yet, probably best to leave out of the principles document. We also need to write down some guidance here, rough (unpolished) ideas sketched out here: #41 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of having a complete list here, there should be a list of example (marked as such) like the existing list, then link to another document containing a maintained list

@torgo torgo added this to the 2022-10-03-week milestone Oct 2, 2022
* The <{iframe}> element's <{iframe/allowfullscreen}> and <{iframe/allowpaymentrequest}> attributes
* The [{{SecureContext}}] WebIDL attribute.
* [Content Security Policy (CSP)](https://w3c.github.io/webappsec-csp/)
* [Referrer Policy](https://w3c.github.io/webappsec-referrer-policy/)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -318,6 +318,23 @@ but in some cases the feature should also be detectable
in the language where it is used
(such as ''@supports'' in CSS).

<h3 id="restriction-options">Use appropriate methods for restricting features</h3>

The Web has a number of somewhat-related features:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we add "for example:" (see below )

@torgo torgo added the Status: Consensus to write We have TAG consensus about the principle but someone needs to write it (see "To Write" project) label Jun 6, 2023
@torgo torgo modified the milestones: 2023-06-05-week, 2023-07-03-week Jun 6, 2023
@rhiaro
Copy link
Contributor

rhiaro commented Jun 6, 2023

Discussed in a breakout today with @torgo @ylafon @maxpassion and @cynthia. From @cynthia:

Need to check if the interoperability has changed in the last year. Permission Policy is now in TR. Secure Contexts is interoperable, think Document Policy isn't yet but it might have changed. Bar for interoperability is two engine implementations, or in TR space - as long as it doesn't break something.

@maxpassion
Copy link
Author

Discussed in a breakout today with @torgo @ylafon @maxpassion and @cynthia. From @cynthia:

Need to check if the interoperability has changed in the last year. Permission Policy is now in TR. Secure Contexts is interoperable, think Document Policy isn't yet but it might have changed. Bar for interoperability is two engine implementations, or in TR space - as long as it doesn't break something.

According to: https://wicg.github.io/document-policy/, Document Policy is now a draft CG report.

Copy link
Member

@cynthia cynthia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PTAL at existing comments!

@torgo torgo modified the milestones: 2023-10-02-week, 2024-03-04-week Mar 3, 2024
Copy link
Contributor

@martinthomson martinthomson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I note that the reporting API is also on this list.

I also agree with Sangwhan's comments on the whole.

@maxpassion
Copy link
Author

Comments for discussion:

  1. Add "for example" in the first sentence, as Yves suggested.
  2. Update the "Referrer Policy" link: https://www.w3.org/TR/referrer-policy/
  3. Remove "Document Policy".

@torgo torgo modified the milestones: 2024-04-01-week, 2024-06-03-week Jun 2, 2024
@torgo torgo requested a review from LeaVerou June 5, 2024 07:19
@torgo
Copy link
Member

torgo commented Jun 5, 2024

@dbaron can you please accept the changes from Sangwhan and myself so that we can potentially land this?

Co-authored-by: Sangwhan "fish" Moon <sangwhan@iki.fi>
@dbaron
Copy link
Member

dbaron commented Jun 5, 2024

@torgo I accepted the changes. (I think yours was a duplicate of Sangwhan's, if I'm reading it right...)

@dbaron
Copy link
Member

dbaron commented Jun 5, 2024

(That said, I think this needs some more work before it's ready to land.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Consensus to write We have TAG consensus about the principle but someone needs to write it (see "To Write" project)
Projects
To Write
Awaiting triage
Development

Successfully merging this pull request may close these issues.

None yet

8 participants