Require transient activation to use API

[marcoscaceres]

Closes #48

To kick off discussion - this would break most sites, so this change would be a multi-year change potentially.

The following tasks have been completed:

• Modified Web platform tests (link to pull request)

Implementation commitment:

• WebKit
• Chromium
• Gecko

---

Preview | Diff

---

Preview | Diff

[reillyeon]

We're tracking this in Chromium as issue 1102381 and the next action is to collect metrics on how often geolocation permission is requested with and without user activation in order to gauge the compatibility impact. As mentioned in #48 there are a number of other experiments currently being pursued in this area as well. I'd be very interested in hearing about plans from Gecko and WebKit in this area.

[marcoscaceres]

filed Gecko bug 1720832. Cc'ing @martinthomson and @johannhof who chimed in on #48.

Filed WebKit bug 228017. Cc @cdumez for any input from WebKit.

[antosart]

I was wondering, has there been any progress on the discussion here?

It could be helpful to restrict to requiring transient activation for showing a permission prompt (i.e. activation would only be required if the permission state is "prompt"). For reference, the linked Gecko bug redirects to its duplicate issue 1602542 which only mentions the requirement for permission prompts. The permission prompt seems to be the real concern also reading through the Webkit issue 228017.

In Chromium we have an implementation of this behind a feature flag - although Chromium still shows a non-blocking quiet UI in this case, allowing the user to manually intervene and grant geolocation permission to the page if they want. This can be a way to more easily ship an otherwise breaking change like this one.

Requiring transient activation for prompting the user seems to align with the design of the <geolocation> element, that by design only displays a prompt to the user after the user interacts with the button.