Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Permission prompt needs to appear somewhere in the system #35

Closed
mgiuca opened this issue Dec 2, 2019 · 4 comments
Closed

Permission prompt needs to appear somewhere in the system #35

mgiuca opened this issue Dec 2, 2019 · 4 comments

Comments

@mgiuca
Copy link
Member

mgiuca commented Dec 2, 2019

@dbaron: from w3ctag/design-reviews#371 (comment)

Another question is that of permissions. It seems like at some point the browser probably wants to ask the user for permission as to whether they want this particular installed web application to be able to access a particular file on the native file system. At the very least, it seems like a risk if there's no permission prompt anywhere in the system -- and it it at least seems like it might be easier to explain that stuff to users at use time rather than at registration time (since it's not clear that it's easy to explain to a user what a application/foo file is). This leads me to two thoughts:

...

it's a little concerning that there doesn't appear to be asynchronous stuff in the explainer that gives a UA that wants to prompt the user for permission to have an opportunity to do so. Perhaps that's OK because the native file system API is sufficiently asynchronous to give the UA a chance to ask for permission through its API surface -- but it would be good to see examples in the explainer that show at what points a UA might choose to ask the user for permission.

Filing a separate bug to consider this. Probably just needs a non-normative recommendation to implementors in a security/privacy considerations section.
@fallaciousreasoning
Copy link
Collaborator

At the moment, before we allow a web app to open a directory, we show this prompt:
Screenshot_20191203_105323

We could do something similar with file handling (presumably before pushing something to the launch queue).

@mgiuca mgiuca mentioned this issue Dec 5, 2019
Closed
5 tasks
@alice
Copy link
Member

alice commented Jan 28, 2020

Back-linking this to TAG review w3ctag/design-reviews#371

@dway123
Copy link
Collaborator

dway123 commented Mar 19, 2021

We've ended up incorporating this into our security model, and discussing a bit more in an internal permissions doc.

The explainer should probably still discuss a permission though...

dway123 added a commit that referenced this issue Mar 26, 2021
@dway123
Mention permissions API Integration
64fcd56 
Addresses #35
@dway123 dway123 mentioned this issue Mar 26, 2021
Merged
dway123 added a commit that referenced this issue Mar 31, 2021
@dway123 @tomayac
Mention permissions API Integration (#57)
02be14c 
* Mention permissions API Integration

Addresses #35

* tomayac rephrasing suggestions

Thanks, @tomayac!

Co-authored-by: Thomas Steiner <tomac@google.com>

* chasephillips suggestions

mostly to split sentences, but also some grammar/spelling fixes.

Co-authored-by: Thomas Steiner <tomac@google.com>
@dway123
Copy link
Collaborator

dway123 commented Mar 31, 2021

Marking this as closed per the commit "mention permissions api integration"

@dway123 dway123 closed this as completed Mar 31, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@alice @mgiuca @fallaciousreasoning @dway123