Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How do connection/disconnection events interact with 'device has been interacted with by the user'? #71

Open
tomrittervg opened this issue Jun 1, 2018 · 4 comments
Labels
privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response. security-tracker Group bringing to attention of security, or tracked by the security Group but not needing response. wide review

Comments

@tomrittervg
Copy link

There doesn't seem to be any information about gamepadconnected and
disconnected as it relates to 'device has been interacted with by the
user'. If I plug in a device, will my origins receive the connected
event? And then will every origin subsequently visit be able to query
my game pad because I interacted with it?

@luser
Copy link
Contributor

luser commented Jun 1, 2018

We could definitely clarify the spec text here. The intention is that a page does not receive any events or get access to any devices via navigator.getGamepads() unless the user has interacted with a device while the page is visible. Once the user has interacted with a device with the page visible, it's assumed that the user will want any newly-connected controllers to be immediately visible, so plugging in a new device would emit a gamepadconnected event right away. If the user has not interacted with a device for this page yet, no events should be emitted.

@LJWatson LJWatson added wide review security-tracker Group bringing to attention of security, or tracked by the security Group but not needing response. labels Jun 4, 2018
@npdoty npdoty added the privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response. label Jun 7, 2018
@jasonanovak
Copy link

Similar to the question that @npdoty raised in #72, is the scope of the gamepadconnected event the top level browsing content or is it broadcast to embedded parties as well?

@cvan
Copy link
Contributor

cvan commented Jun 29, 2018

assuming the Gamepad API gets Feature Policy support, if the parent page has an HTTP response header of Feature-Policy: gamepad 'self' and the document body includes <iframe allow="gamepad" src="…"></iframe>, I would expect only that particular framed content to then have Gamepad API access.

@marcoscaceres
Copy link
Member

Yeah, we might still need to clarify this more... it's currently implied that it's only per browsing context, but the spec is not super clear on this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
privacy-tracker Group bringing to attention of Privacy, or tracked by the Privacy Group but not needing response. security-tracker Group bringing to attention of security, or tracked by the security Group but not needing response. wide review
Projects
None yet
Development

No branches or pull requests

7 participants