1705289 - Require recent user gesture for getDisplayMedia() again

Status: RESOLVED FIXED

(Core :: WebRTC: Audio/Video, defect, P2)

Description

[Karl Tomlinson (:karlt)]

+++ This bug was initially created as a clone of Bug #1679735 +++

"triggered by user activation" seems to have been the intention of "called from a user gesture handler", but sticky activation is what was implemented.

The spec has since loosened from "triggered by" to "transient activation".

If bug 1557174 is not fixed, then we'd need to also require the gesture there for any security benefits.

Comment 1

[Karl Tomlinson (:karlt)]

Consider supporting top-level activation for cross-origin iframes with allow="display-capture".
The purpose of the transient activation test is to require a user gesture and the precise location of the user gesture is not important.
There is precedent in Gecko for using toplevel activation, in media autoplay. "allowed to play" is user-agent determined.

This would need some adjustment to HasValidTransientUserGestureActivation() to support out of process use.

Would any host sites want to grant an iframe "display-capture" permission but restrict its getDisplayMedia() calls to a user gesture specifically on the cross-origin iframe?

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug is a defect, but please change it back in case of error.

Comment 3

[Karl Tomlinson (:karlt)]

https://treeherder.mozilla.org/jobs?repo=try&revision=08504ad95e6ecf9c505a2d6a080324aa0c102338

Comment 4

[Karl Tomlinson (:karlt)]

Attachment: Bug 1705289 revert from sticky to transient activation requirement for getDisplayMedia() r?jib

Backed out changeset 7a50bf09d726

There was no known value in relaxing the activation constraint because it
didn't resolve the use case that was thought to have regressed, but apparently
didn't. https://bugzilla.mozilla.org/show_bug.cgi?id=1704278#c24

This restores specified behavior, which is similar to Safari.
https://github.com/w3c/mediacapture-screen-share/issues/167#issuecomment-821068685

Comment 5

[Karl Tomlinson (:karlt)]

Attachment: Bug 1705289 require user gesture for screen capture through non-standard mediaSource in getUserMedia() r?jib

for consistency with getDisplayMedia().

System callers are trusted to be excluded from the requirement.
The exclusion may not be strictly necessary for capture previews, but removes
any doubt and simplifies testing.

Depends on D122192

Comment 6

[Karl Tomlinson (:karlt)]

Attachment: Bug 1705289 loosen message on failure to meet getDisplayMedia() user activation requirement r?jib

This never needed to be called directly from a handler, though a
(potentially async) call should at least be triggered by a handler.
https://hg.mozilla.org/mozilla-central/rev/4d512fa7b071#l1.19

Depends on D122193

Comment 7

[Karl Tomlinson (:karlt)]

Attachment: Bug 1705289 use more restrictive variable declarations r?jib

No behavior changes.

Depends on D123559

Comment 8

[Karl Tomlinson (:karlt)]

Attachment: Bug 1705289 Remove spurious mozMediaSource media track constraint from tests r?jib

This constraint does not exist.
https://hg.mozilla.org/mozilla-central/rev/49e5c7d46ea0cd9515d292131259ac539652ce2b#l6.25

Depends on D123560

Comment 9

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/e718e6c8bf0e
https://hg.mozilla.org/mozilla-central/rev/3d86317782d2

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

Since the status are different for nightly and release, what's the status for beta?
For more information, please visit auto_nag documentation.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/056185440c81
loosen message on failure to meet getDisplayMedia() user activation requirement r=jib
https://hg.mozilla.org/integration/autoland/rev/865e8b4ab40e
use more restrictive variable declarations r=jib
https://hg.mozilla.org/integration/autoland/rev/d9e75cc820bc
Remove spurious mozMediaSource media track constraint from tests r=jib

Comment 12

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/056185440c81
https://hg.mozilla.org/mozilla-central/rev/865e8b4ab40e
https://hg.mozilla.org/mozilla-central/rev/d9e75cc820bc