Wotcher TAG!
I'm requesting a TAG review of the Popup API. This is a third attempt at a TAG review for this feature; see #599 for the first, and #680 for the second.
A very common UI pattern on the Web, for which there is no native API, is "popup UI" or "popups". Popups are a general class of UI that have three common behaviors:
- Popups always appear on top of other page content.
- Popups are ephemeral. When the user "moves on" to another part of the page (e.g. by clicking elsewhere, or hitting ESC), the popup closes.
- Popups (of a particular type) are generally "one at a time" - opening one popup closes others.
We are proposing a set of APIs to make this type of UI easy to build.
Further details:
You should also know that...
This is a third attempt at a TAG review for this feature. The first attempt was closed due to the lack of an Anchor Positioning proposal. That has now been proposed, and there's a draft spec. The second attempt was closed because we changed directions from a <popup> element to a popup content attribute. This third TAG review is for that new content-attribute-based approach.
We'd prefer the TAG provide feedback as (please delete all but the desired option):
💬 leave review feedback as a comment in this issue and @-notify @mfreed7
Security and Privacy questionnaire for TAG
2.1. What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?
None. This feature does not expose any extra information to sites.
2.2. Do features in your specification expose the minimum amount of information necessary to enable their intended uses?
Yes - no new information.
2.3. How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?
N/A - no PII.
2.4. How do the features in your specification deal with sensitive information?
N/A - no sensitive information.
2.5. Do the features in your specification introduce new state for an origin that persists across browsing sessions?
No.
2.6. Do the features in your specification expose information about the underlying platform to origins?
No.
2.7. Does this specification allow an origin to send data to the underlying platform?
No.
2.8. Do features in this specification enable access to device sensors?
No.
2.9. Do features in this specification enable new script execution/loading mechanisms?
No.
2.10. Do features in this specification allow an origin to access other devices?
No.
2.11. Do features in this specification allow an origin some measure of control over a user agent’s native UI?
No. While pop-ups are shown in the top-layer, they cannot escape the frame bounds, and cannot be shown over the top of a UA's native UI.
2.12. What temporary identifiers do the features in this specification create or expose to the web?
None.
2.13. How does this specification distinguish between behavior in first-party and third-party contexts?
It does not distinguish. Pop-ups are isolated to their frame, for both 1st and 3rd party frames.
2.14. How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?
Just fine. No exposure of private browsing state.
2.15. Does this specification have both "Security Considerations" and "Privacy Considerations" sections?
There are no known security impacts of the features in this specification.
2.16. Do features in your specification enable origins to downgrade default security protections?
No.
2.17. How does your feature handle non-"fully active" documents?
N/A
2.18. What should this questionnaire have asked?
N/A
Wotcher TAG!
I'm requesting a TAG review of the Popup API. This is a third attempt at a TAG review for this feature; see #599 for the first, and #680 for the second.
A very common UI pattern on the Web, for which there is no native API, is "popup UI" or "popups". Popups are a general class of UI that have three common behaviors:
We are proposing a set of APIs to make this type of UI easy to build.
Further details:
You should also know that...
This is a third attempt at a TAG review for this feature. The first attempt was closed due to the lack of an Anchor Positioning proposal. That has now been proposed, and there's a draft spec. The second attempt was closed because we changed directions from a
<popup>element to apopupcontent attribute. This third TAG review is for that new content-attribute-based approach.We'd prefer the TAG provide feedback as (please delete all but the desired option):
💬 leave review feedback as a comment in this issue and @-notify @mfreed7
Security and Privacy questionnaire for TAG
2.1. What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?
None. This feature does not expose any extra information to sites.
2.2. Do features in your specification expose the minimum amount of information necessary to enable their intended uses?
Yes - no new information.
2.3. How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?
N/A - no PII.
2.4. How do the features in your specification deal with sensitive information?
N/A - no sensitive information.
2.5. Do the features in your specification introduce new state for an origin that persists across browsing sessions?
No.
2.6. Do the features in your specification expose information about the underlying platform to origins?
No.
2.7. Does this specification allow an origin to send data to the underlying platform?
No.
2.8. Do features in this specification enable access to device sensors?
No.
2.9. Do features in this specification enable new script execution/loading mechanisms?
No.
2.10. Do features in this specification allow an origin to access other devices?
No.
2.11. Do features in this specification allow an origin some measure of control over a user agent’s native UI?
No. While pop-ups are shown in the top-layer, they cannot escape the frame bounds, and cannot be shown over the top of a UA's native UI.
2.12. What temporary identifiers do the features in this specification create or expose to the web?
None.
2.13. How does this specification distinguish between behavior in first-party and third-party contexts?
It does not distinguish. Pop-ups are isolated to their frame, for both 1st and 3rd party frames.
2.14. How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?
Just fine. No exposure of private browsing state.
2.15. Does this specification have both "Security Considerations" and "Privacy Considerations" sections?
There are no known security impacts of the features in this specification.
2.16. Do features in your specification enable origins to downgrade default security protections?
No.
2.17. How does your feature handle non-"fully active" documents?
N/A
2.18. What should this questionnaire have asked?
N/A