Allow to propagate more props to amp-iframe from amp-consent

[adriafolchmrf]

Description

A couple of days ago, legal requirements where changed in Spain for the consent, due to that, there are some attributes already available in the amp-iframe found in this list that would be interesting to be able to configure in the amp-consent, same way as the sandbox attribute which allow some modification for the initial amp-iframe rendered inside it.

Alternatives Considered

Allow to extend the json of amp-consent to something like

{
    // amp-consent default config
    "consentInstanceId": "my-consent",
    "consentRequired": "remote",
    "checkConsentHref": "https://example.com/api/check-consent",
    "promptUI": "consent-ui",
    "onUpdateHref": "https://example.com/update-consent"
    // proposal
    "allowfullscreen": true,
    "allowpaymentrequest": true,
    "allow": "geolocation"
}

Additional Context

No response

[erwinmombay]

@adriafolchmrf thanks for the report. the team will take a look at this and prioritize

cc @powerivq

[powerivq]

We would consider opening them up if there are proper use cases. Can you think of the scenario where each one is needed? @adriafolchmrf

For payment, are you trying to do a pay-for-not-tracking?

[xbeumala]

mainly 2 use cases:

1. Get a membership subscription in 1-click (paywall)
2. Pay-for-not tracking cookie-wall

if we work on a PR would you be open to land it?

[powerivq]

@xbeumala I do not think there is a good reason to have them configurable. I would rather just add these into the amp-iframe attributes. However, I do think we need to look at each attribute case-by-case from a security and privacy standpoint. Please list all attributes you intend to add and we will take a look.

[powerivq]

https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/allowPaymentRequest FYI allowpaymentrequest is deprecated.

allowfullscreen: I do not know why use case would require it. Can you provide a scenario?

allow="geolocation": sounds fine to me in general

[marcmrf]

PR created adding the attribute for the iframe created via amp-consent. Amp-iframe compoment already allows to configure allow attribute. Let's see what you think 🙏

[powerivq]

Closed since PR merged.