[cap-talk] Ambient authority in the Web Geolocation API

[David-Sarah Hopwood]

David-Sarah Hopwood wrote:
[...]
> So, only a top-level frame should be able to request geolocation data.
> If it does, the browser shows a non-modal confirmation bar, like the
> pop-up bar, which asks the user whether they want to grant access. If they
> do, then the bar updates to say something like "This page can see your
> current location", with an option to revoke access. The bar remains
> visible for as long as the geolocation is being updated for that frame.
> (It could be updated by calling an event handler registered by the frame,
> for example.)
> 
> Switching away from a tab automatically revokes geolocation access; to
> reenable it, the user has to switch back to that tab *and* click to allow
> it again.

Navigating away from the frame would also revoke access. (This is not as
much of a restriction as it seems; if a site wants to allow the effect of
navigation while retaining geolocation access, it can navigate a subframe,
and that subframe might take up the whole visible page.)

-- 
David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com