Repository navigation
[mediaqueries-5] Hide the application context from cross-origin child contexts #14125 - #14625
marcoscaceres wants to merge 1 commit into
Conversation
|
Thanks for making these edits, Marcos! |
| In a child browsing context that is [=same origin=] with all of its ancestors, | ||
| the matching values must match those of the [=top-level browsing context=]. | ||
| In any other child browsing context, | ||
| the user agent must act as if the [=top-level browsing context=] is not an [=application context=]. |
There was a problem hiding this comment.
It's not clear to me from this sentence that this means standalone and minimal-ui should also be hidden from a cross-origin child context, is it worth making that more explicit here rather than relying on the Only applicable in an [=application context=]. piece in those value definitions to make that connection?
| In a child browsing context that is [=same origin=] with all of its ancestors, | ||
| the matching values must match those of the [=top-level browsing context=]. | ||
| In any other child browsing context, | ||
| the user agent must act as if the [=top-level browsing context=] is not an [=application context=]. |
There was a problem hiding this comment.
How should it act as if it is not an application context? Return the default value of browser? Or purposefully leave that up to the UA? Perhaps in cross-origin contexts we should always be returning browser?
Today any embedded frame, from any site, can use
display-modeto tell that the page is an installed app. This hidesapplication,standaloneandminimal-uifrom child contexts that aren't same origin with all of their ancestors.