1498142 - Introduce allowusermedia attribute for FeaturePolicy camera and microphone

Status: RESOLVED INVALID

(Core :: DOM: Security, enhancement)

Description

[Andrea Marchesini [:baku]]

https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allowusermedia

By spec, if this attribute exists, FeaturePolicy should allow camera and microphone for any origin.

Note that, at the moment, the attribute existence doesn't really matter, because our default policy allows camera and microphone to be backward compatible.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: allowusermediarequest.patch

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Comment on attachment 9016208 [details] [diff] [review]
allowusermediarequest.patch

Review of attachment 9016208 [details] [diff] [review]:
-----------------------------------------------------------------

My understanding is that no browser implements allowusermedia, so I don't think we should land this.

See https://docs.google.com/presentation/d/1Sg_1TVCcKJvZ8Egz5oa0CP01TC2rNdv9HVu7W38Y4zA/edit#slide=id.g2a8020271b_6_6
and https://github.com/w3c/mediacapture-main/issues/434#issuecomment-278499864 and on.

Basically, mediacapture-main still mentions allowusermedia, but everyone agrees it is too coarse, and that allow="camera;microphone" is the way to go.

Fixing the mediacapture spec language to say so, is sadly blocked on https://github.com/w3c/permissions/pull/163 which is ... now merged as of a month ago? YAY!

I'll add a PR. In any case, no to allowusermedia I believe.

Comment 3

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

PR is here https://github.com/w3c/mediacapture-main/pull/546.