Add "popups" permission type

[samuelmaddock]

I have a use case where I'd like to open two popups at a time when acting upon a user gesture. In Chrome, this results in one of the popups getting blocked unless the user has set the permission to allow popups from my website to open.

It'd be great if I could prompt the user to allow popup permission when one popup does get blocked.

[marcoscaceres]

Out of interest, what problem are you solving with the popups?

[samuelmaddock]

@marcoscaceres I have a requirement of showing arbitrary content on the web with a custom UI to go along with it. To do so I need two top-level browser contexts.

Initially I started out using Electron, but ran into blockers related to DRM for showing content like Netflix. Then I moved to iframes with security bypasses via an extension. Now other problems are leading me to use two popups.

More info in a blog post I just published.
https://blog.samuelmaddock.com/posts/losing-50000-chrome-extension-users/

[marcoscaceres]

@domenic, @annevk, I think this ⬆️ is really a HTML question (as it relates to window.open())... Popups kinda meet the definition of "powerful feature", in that they require express user permission to allow a popup to work. And it may be helpful for developers to know if their popups would otherwise be denied from popping up....

Thus, I wonder if there is something here with considering?

Having said that, there are strong mitigations in place to prevent popups without a user gesture. So, the question is: is it possible to fully block all popups, irrespective of transient activation. And if so, would exposing the permission state of "popups" be worthwhile?

// can I pop up windows?
const status = await permissions.query({ name: "popup" });
if (status.state === "granted") 
  window.open("page")
else 
   // make an in-page popup, or navigate...

[annevk]

This seems more like a Document Policy [sic] thing to me?

[miketaylr]

What are the permission semantics? Allow unlimited pop-ups per user gesture? Something else? It seems like you'd want the user in control of that, rather than the server (if you wanted it at all).