Block navigator.vibrate in cross-origin iframes

[dontcallmedom]

Chrome is blocking the vibration API in cross-origin iframes.

The current spec allows for that behaviour, but if that's the one other browsers are converging toward, we should probably make it the explicitly required behaviour.

[lknik]

I believe this is a good idea - at least document it as an option. Even better, a requirement.

[annevk]

Firefox is also doing this: https://bugzilla.mozilla.org/show_bug.cgi?id=1591113.

[anssiko]

Seems we should make this normative.

@annevk is there a less convoluted way to spec this than what is proposed below?

Replace the following step 1 in perform vibration:

An implementation MAY return false and terminate these steps.

With:

If this Navigator object's relevant global object's associated Document's browsing context's active document's origin is not same origin-domain with the origin of the current settings object of this Navigator object, return false and terminate these steps.

[annevk]

It might be worthwhile to wait on whatwg/html#4966 at which point we can define a primitive such as "is a top-level origin" which you give an origin and then it returns true or false. Or perhaps even "has a top-level origin" which you can give some kind of object and it takes it from there.

We'll need this for a large number of features.