allow-top-navigation-by-user-activation

[domenic]

Hello TAG!

I'm requesting a TAG review of:

• Name: The new "allow-top-navigation-by-user-activation" <iframe sandbox> flag
• Specification URL: https://html.spec.whatwg.org/multipage/browsers.html#attr-iframe-sandbox-allow-top-navigation-by-user-activation
• Explainer, Requirements Doc, or Example code: see Add a new 'allow-top-navigation-by-user-activation' flag to iframe sandbox to require a user activation for top-level page navigation WICG/interventions#42 for some background, and note how the proposal morphed from initially changing the behavior of allow-top-navigation to introducing a new keyword, allow-top-navigation-by-user-activation
• Primary contacts: @domenic, @lubin2010

Further details (optional):

• Relevant time constraints or deadlines: Chrome is hoping to ship this in a branch that will branch March 2, so any feedback before then would be helpful.
• I have read and filled out the Self-Review Questionnare on Security and Privacy. Although this touches on related areas, it's largely a strengthening of the isolation that was present before (with allow-top-navigation), and none of the questions seem directly relevant.
• I have reviewed the TAG's API Design Principles

We'd prefer the TAG provide feedback as (please select one):

• open issues in our Github repo for each point of feedback
• open a single issue in our Github repo for the entire review (preferably comment on Add allow-top-navigation-by-user-activation sandbox token whatwg/html#2292)
• leave review feedback as a comment in this issue and @-notify [github usernames]

[cynthia]

First of all, apologies for the delay - I see that we completely missed the requested deadline.

I'm pretty happy with this - it seems like the ground work for defining a trusted event / user interaction has made good progress, so I don't think we have any objections on moving this forward.

As long as whatwg/html#1903 gets properly followed up on, LGTM. I've subscribed to that issue, so that nit shouldn't block this. Thanks a lot!