Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow opt out of only text fragment scrolling #226

Open
zcorpan opened this issue Jun 22, 2023 · 4 comments
Open

Allow opt out of only text fragment scrolling #226

zcorpan opened this issue Jun 22, 2023 · 4 comments

Comments

@zcorpan
Copy link

zcorpan commented Jun 22, 2023

In #131 an opt out of scrolling caused by text fragment URL or fragment URL was added to address information leaks #76 and #79

I think sites may want to opt out of text fragment scrolling but not regular URL fragment scrolling. The privacy issue is only for text fragments as far as I can tell.

Maybe something like Document-Policy: disable-text-fragment-scrolling

@bokand
Copy link
Collaborator

bokand commented Jun 22, 2023

The privacy issue is only for text fragments as far as I can tell.

The existence of certain element-ids is also potentially sensitive information so I wouldn't say it's only for text fragments. That said, I agree that the raw text is meaningfully different and (unlike element ids) cannot be mitigated by authors who understand the issue.

Maybe something like Document-Policy: disable-text-fragment-scrolling

My initial hesitation to adding something like this was that a knee-jerk reaction would lead to this being blindly cargo-culted around the web, hurting usability. I think that's less of a risk at this point so this seems ok to me.

@zcorpan
Copy link
Author

zcorpan commented Jun 27, 2023

The existence of certain element-ids is also potentially sensitive information

Yes, but the behavior has existed since day 1 on the web so it should be well understood.

I think that's less of a risk at this point so this seems ok to me.

👍

@annevk
Copy link
Collaborator

annevk commented Jun 28, 2023

How many web developers are asking for this distinction? I'd rather not offer this unless the existing mitigation is too prohibitive.

@zcorpan
Copy link
Author

zcorpan commented Jun 28, 2023

No data on that, this came up from internal discussion at Mozilla.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants