1266494 - Limit navigator.geolocation.watchPosition() to secure contexts

Status: RESOLVED DUPLICATE of bug 1072859

(Core :: DOM: Geolocation, defect)

Description

[Richard Barnes [:rbarnes]]

This is clearly a powerful feature, so it's a natural candidate for restriction.  Chromium is restricting all of navigator.geolocation as of 50:

https://codereview.chromium.org/1530403002/

Our telemetry shows that only ~0.1% of the usage of watchPosition() is in non-secure contexts.

http://mzl.la/1VEBbZq

That's low enough that we should go ahead and turn it off.

Comment 1

[Kohei Yoshino]

Is there any reason why we cannot limit getCurrentPosition() as well like Chromium? If not, this is a dup of Bug 1072859.

Comment 2

[Kohei Yoshino]

Posted the site compatibility doc: https://www.fxsitecompat.com/en-CA/docs/2016/use-of-geolocation-watchposition-will-be-limited-to-secure-sites/

Comment 3

[Doug Turner (:dougt)]

getCurrentPosition() should also be limited.

Comment 4

[Michelangelo De Simone [Offline] [:mds]]

Marking as DUP of #1072859: watchPositiong() and getCurrentPosition() should both be limited to secure contexts.