Require user activation to use API

[pes10k]

Geolocation functionality poses clear benefits and risks to user privacy. In order to better distinguish the former from the latter, and prevent location from becoming an unknown ongoing tracking vector, the spec should require signals that the user is intentionally interacting with a frame before the frame can request location data (even for a frame that was previously given location permission).

Two common signals that should be incorporated into the spec are that frames need to be visible, and to have received a user activation before they can access location information, even if the frame was previously given permission.

[reillyeon]

The Blink engine already requires a page to be visible in order to receive callbacks from the Geolocation API. I support adding this behavior as a normative requirement to the specification assuming that other implementations are on board.

What are your thoughts about requiring a user-activation-received frame vs. requiring a user activation to request geolocation permission?

[pes10k]

The Blink engine already requires a page to be visible in order to receive callbacks from the Geolocation API. I support adding this behavior as a normative requirement to the specification assuming that other implementations are on board.

🤗

What are your thoughts about requiring a user-activation-received frame vs. requiring a user activation to request geolocation permission?

I think these are both important. The latter makes it clear(er) to the user what site / party is making the permission request, the former reduces the ability for the capability to be misused over the long term.

[marcoscaceres]

The Blink engine already requires a page to be visible in order to receive callbacks from the Geolocation API. I support adding this behavior as a normative requirement to the specification assuming that other implementations are on board.

That sounds really neat. I'd be onboard with implementing that if we don't already do it in Gecko.

What are your thoughts about requiring a user-activation-received frame vs. requiring a user activation to request geolocation permission?

That could be fun... though I imagine it's gonna break a ton of sites :D

[marcoscaceres]

cc @cdumez for input on this from WebKit.

[engedy]

We could also consider restricting geolocation access to active documents whose origin is same origin-domain with the currently focused area document. There are obviously compatibility risks here as well, partially overlapping with those associated with the user-activation-received requirement. Similarly to what we did before restricting APIs to secure contexts, we probably need to add telemetry to measure the expected breakage first.

[IreneKnapp]

As the volunteer handling this review for PING, I want to make a record here that I agree that this is an important protection.

[kdzwinel]

FWIW I made a simple test page (https://output.jsbin.com/yapihuf) for checking if a site with geolocation API access granted can get location updates while in the background. WebKit and Blink both don't allow it while Gecko currently does (on both desktop and android). I opened a bug report for Gecko here - https://bugzilla.mozilla.org/show_bug.cgi?id=1653549 .

[engedy]

Thanks for verifying, Konrad!

Given that Blink and WebKit already require the page to be visible, there seems to be little to no compatibility risk to imposing this requirement. And as per Marcos's comment, Gecko is also on board with implementing it. In light of that, making this behavior a normative requirement in the spec sounds reasonable to me.

The user-activation and focused-area requirement will probably need more discussion and compatibility risk analysis.

[pes10k]

Thanks too @kdzwinel !

And just to avoid possible confusion, my proposal isn't to require the frame to be focused to receive updates (though thats appealing too); just that it received an activation at some point during the parent frame's lifetime

[marcoscaceres]

Thanks for filling the Gecko bug @kdzwinel.

Two common signals that should be incorporated into the spec are that frames need to be visible,

I think we should definitely spec this one...

and to have received a user activation before they can access location information, even if the frame was previously given permission.

This can probably be handled by the UA (see how Firefox dealt with push notifications), as this would break too much stuff.

[marcoscaceres]

Closed via b1fac55.

[pes10k]

@marcoscaceres i can't find where in the commit addresses the user-activation-received frame. Can you direct me to that part of the new text (apologies if im missing it in the diff)? Otherwise i'll reopen the issue while that part of the issue is still being discussed.

[marcoscaceres]

Oh, we are not spec'ing the user-activation part (no one implements that!), only visibility detection. Sorry for the misunderstanding.

Enabling geolocation in third party contexts requires a Permissions Policy.