'focus-without-user-activation' permissions policy #1066
Description
こんにちは TAG-さん!
I'm requesting a TAG review of a new permissions policy named 'focus-without-user-activation'.
The focus-without-user-activation permissions policy help controls the use of automated focus in a main frame or <iframe>. The proposed permissions policy can be used to limit the use of automatic focus. Essentially, when the policy is disabled in a document, scripted and automatic focus will only work if the focus has been initialized through user activation. This essentially means that autofocus will be disabled (unless a new element is inserted, with autofocus, as a result of user gesture). The scripted focus will also only work if it has started with user gesture or initiated from current frame's parent.
- Explainer¹: https://github.com/gabrielsanbrito/webappsec-permissions-policy/blob/main/policies/focus-without-user-activation.md
- Specification: Feature Policy:
focus-without-user-activationwhatwg/html#10672 - WPT Tests:
- https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
- https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy-cross-origin.tentative.https.sub.html?label=experimental&label=master&aligned, https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-by-permissions-policy.tentative.https.sub.html?label=experimental&label=master&aligned
- https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-disabled-tentative.html?label=master&label=experimental&aligned
- https://wpt.fyi/results/permissions-policy/experimental-features/focus-without-user-activation-enabled-tentative.sub.html?label=experimental&label=master&aligned
- User research: N/A
- Security and Privacy self-review²:
- GitHub repo: https://github.com/w3c/webappsec-permissions-policy, https://github.com/whatwg/html
- Primary contacts:
- Organization/project driving the specification: Microsoft
- Multi-stakeholder support³:
- Chromium comments: https://chromestatus.com/feature/5179186249465856
- Mozilla comments:
focus-without-user-activationfeature policy mozilla/standards-positions#1080 - WebKit comments:
focus-without-user-activationfeature policy WebKit/standards-positions#406
- Status/issue trackers for implementations⁴: https://chromestatus.com/feature/5179186249465856
Further details:
- I have reviewed the TAG's Web Platform Design Principles
- Previous early design review, if any: https://github.com/w3ctag/design-reviews/issues/####
- Relevant time constraints or deadlines:
- The group where the work on this specification is currently being done:
- The group where standardization of this work is intended to be done (if different from the current group):
- Major unresolved issues with or opposition to this specification:
- This work is being funded by:
Reacted by Sanket Joshi
Activity
matatk commentedon Apr 30, 2025
Hi @siliu1, and thanks for your review request.
We are supportive of this use case, and your proposed approach seems reasonable.
However, it would be really helpful for reviewers if you could include the alternatives that were considered in the explainer, and briefly describe why they were rejected.
We are aware of a few alternative approaches that had been explored (thanks @dandclark for highlighting these):
The
disallowprogrammaticfocusattribute. (Described in a draft explainer).The alternative policy name from the same draft explainer. (For this one it does seem logical to use the existing
focus-without-user-activationname, which we understand was suggested during discussions in the WG.)A
sandboxflag (as per Prevent programmatic focus in iframe w3c/webappsec-permissions-policy#273).Please could you add these - and the reasons for rejecting them - to the explainer?
Thanks again to @dandclark for assisting with this review.
ffiori commentedon Jul 18, 2025
Hi @matatk, thanks for the review! I just updated the explainer with your suggestions, let me know your thoughts. Thanks!
By the way, I just realized the explainer link in the original post from @siliu1 is outdated and this link should be the official one https://github.com/w3c/webappsec-permissions-policy/blob/main/policies/focus-without-user-activation.md
matatk commentedon Jul 23, 2025
Hi @ffiori. Thanks for your updates to the explainer; they're helpful, and we continue to be happy with the direction the work has taken, so will close this review now. Thanks again for your review request, and to @dandclark for his input on this one.