-
Notifications
You must be signed in to change notification settings - Fork 29
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Should the default mediasession permission policy value be self instead of * #302
Comments
@steimelchrome, is this doable or has this been out for too long? |
My gut reaction is that it's been too long at this point, though I don't think Chrome has any metrics for this specific case to know how much would break if we switched |
Are there any pressing security or privacy concerns with leaving it as "*"? I know it's not ideal having that policy, but unless there something pretty serious here, we might just need to let it be. Are there sufficient mitigations (e.g., audio is muted by default, etc.) that this won't be huge issue in practice? @youennf, @jan-ivar, or anyone else wdty? Should we let this one go... and did PING by or anyone else (wide review) raise this as a blocker? If not, we should be prepared to justify the decision to use and keep the "*" policy. |
So, let me ask: can a cross-origin iframe set the media session without user interaction and display something on my lock screen? |
Following on #299, we probably need to understand how web compatible it is to use 'self' as a default.
The text was updated successfully, but these errors were encountered: