Permissions policy for workers

[antosart]

Specification title

Permissions policy for workers

Specification or proposal URL (if available)

No response

Explainer URL (if available)

https://github.com/explainers-by-googlers/workers-permissions-policy/blob/main/README.md

Proposal author(s)

@antosart

web-feature id

No response

MDN URL

No response

Caniuse.com URL

No response

Bugzilla URL

No response

Mozillians who can provide input

No response

WebKit standards-position

WebKit/standards-positions#701

Other information

No response

[smaug----]

Why the need for the new allow property? Why couldn't we inherit always from the document? The explainer says "this would break backwards compatibility" but what sorts of compat issues are you worried about?

[antosart]

Inheriting always from the document would definitely work for dedicated workers. For shared workers started/connected to by documents with different policies, though, that would result in races/inconsistencies depending on which document starts the shared worker first.

[smaug----]

Could we key *Workers based on policy?

[antosart]

Could we key *Workers based on policy?

I think that's a valid alternative. Naively I would have the impression that it just makes things more complicated without much benefit, and it breaks the current contract that only a shared worker can run for a given URL at any given time (although I'm not sure how important that is). Any particular reasons why you believe that's preferable?

[smaug----]

Just trying to find some approach to have an easy to use by default API.

[domfarolino]

Naively I would have the impression that it just makes things more complicated without much benefit, and it breaks the current contract that only a shared worker can run for a given URL at any given time (although I'm not sure how important that is).

My 2c (expressed in explainers-by-googlers/workers-permissions-policy#3) is that we should key shared workers by their client-provided SharedWorkerOptions#allow, and just prevent you from connecting to the worker if you don't match all of the other client allow permissions lists. That's consistent with everything else in SharedWorkerOptions, like extendedLifetime which requires a match (and errors otherwise).