1113841 - Permissions should be granted to the app scope

Status: RESOLVED WONTFIX

(Core Graveyard :: DOM: Apps, defect)

Description

[:Harald Kirschner :digitarald]

#1 As a developer I have a music streaming app that uses an iframe to play back music. The audio playback in the iframe requires the content audio channel to play in the background.

#2 As a developer I have a navigation app. The map runs in an iframe and needs geolocation to work. Geolocation permission is requested by the app.

In both cases the (web, not privileged) permission currently only works within the packaged apps scope and not the iframe. App scope should allow a developer to declare that external origin to be part of the app and therefor also receive permissions.

Comment 1

[:Harald Kirschner :digitarald]

Jonas might know if this is covered in the current spec.

Comment 2

[Ben Francis [:benfrancis]]

As I understand it the maximum scope of an app will be a single origin, so I don't think exactly what you describe here will be possible.

However, we might want to restrict permissions to a scope as a subset of an origin.

Comment 3

[:Harald Kirschner :digitarald]

> As I understand it the maximum scope of an app will be a single origin, so I don't think exactly what you describe here will be possible.

I am playing devils advocate on a pattern that is adopted broadly: A multitude of sites depend on dubdomains to serve mobile form factors (e.g. m.facebook.com and www.facebook.com). Are we really sating that these domains can't be the same "app"? This will cause fragmentation, forcing developers to submit multiple apps for various form factors.

ni" on Marco to provide input from the app side.

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Sadly we can't really usefully block access to APIs on a more narrow basis than origins. Origins are just too engrained as the security boundary in the web security model.

For example, if we give http://example.com/A.html access to an API, but deny http://example.com/B.html access to the same API, then B could simply do:

<iframe src="http://example.com/A.html" id='frame'></iframe>

$('frame').onload = function() {
  var s = this.contentDocument.createElement("script");
  s.textContent = "navigator.someAPI('someparam');"
  this.contentDocument.body.appendChild(s);
}


So I don't think we should limit permissions to the scope of the app.

Comment 5

[Marcos Caceres [:marcosc]]

What Jonas said :)

Comment 6

[:Harald Kirschner :digitarald]

What about wildcards, *.facebook.com?

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

You mean granting access to an API for multiple domains? Rather than part of a domain?

Note that the "scope" of an app (as in, the set of URLs which an app "captures") is limited to the origin of manifest. Otherwise apps would be able to "steal" URLs from other websites. So the title of this bug wouldn't help you.


However granting a permission to several domains at once seems doable. But I'm not sure doing it through manifests is the way to go. It's something that I would want to be able to do for plain websites as well.

One solution would be to modify the geolocation API so that the caller can ask for access for several origins at once.

There has been discussions about allowing websites to indicate that their origin spans multiple domains. So that all of *.facebook.com would be a single origin for many practical purposes. That would be another solution.

How important is solving this issue? What specific problems are you trying to solve?

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Core Graveyard / DOM: Apps is inactive. Closing all bugs in this component.