1754005 - Consider granting temporary ALLOW for site permissions

Status: RESOLVED FIXED

(Firefox :: Site Permissions, enhancement, P2)

Description

[Paul Zühlcke [:pbz]]

Geolocation permission prompts currently are currently one-off. That means for every geolocation request a new prompt is shown and accepting the prompt only grants access for that specific request, unless users check the "remember" checkbox.

We should consider granting temporary ALLOW permissions if users accept geolocation prompts. We do something similar for WebRTC permissions already, see Bug 1693621.

Previously there have been concerns about handing out temporary allows, because they could be abused using sub-frames. However, since we've implemented the Permissions API, geolocation requests can only come from the top BrowsingContext.

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

From https://permission.site I notice temporary BLOCK permissions already work for the lifetime of the page (*), so hopefully adding ALLOW isn't that different. Safari grants for the duration of the page (without any timeout that I could tell even after several days), so this seems reasonable to me.

*) Modulo that typing

await navigator.permissions.query({name: "geolocation"})

...into web console still yields "prompt" rather than "denied" even after denying location. It should say "denied" to be consistent with the NotAllowedError instead of prompt it will get from for the duration of the page. I suspect fixing this might be the bigger task here perhaps for both?

Comment 2

[Paul Zühlcke [:pbz]]

Attachment: Bug 1754005 - Temporary allow for site permissions. r=#permissions!,nchevobbe!

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/025f08356074
Temporary allow for site permissions. r=permissions-reviewers,nchevobbe,timhuang

Comment 4

[tszentpeteri]

https://hg.mozilla.org/mozilla-central/rev/025f08356074

Comment 5

[Dianna Smith [:diannaS]]

:pbz would you like to nominate this for fx131 release notes? Would be a good call outl

Comment 6

[Paul Zühlcke [:pbz]]

Release Note Request (optional, but appreciated)
[Why is this notable]:
See https://groups.google.com/a/mozilla.org/g/firefox-dev/c/ln6eGfdUPns

[Suggested wording] (not sure how detailed this should be):
Firefox will now temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions get removed after 1 hour or when the tab gets closed.
[Links (documentation, blog post, etc)]:
More details in the email I sent to firefox-dev: https://groups.google.com/a/mozilla.org/g/firefox-dev/c/ln6eGfdUPns

Comment 7

[Dianna Smith [:diannaS]]

Added to Fx131 nightly release notes (takes about 20 min to appear)
https://www.mozilla.org/en-US/firefox/131.0a1/releasenotes/