Carry UserActivation across cross-document navigations

[nickcoury]

There may be a better category for this issue, but starting here as it came up in the scope of cross-document View Transitions trying to mirror the experience of a SPA with a MPA architecture.

There are numerous APIs that require user activation, and some that aren't specced to but require it based on browser implementation.

This is scoped to the document, and is lost after a same-origin, cross-document navigation. Yet conceptually, if the same transition was a same-document SPA transition, it would be maintained. I can't think of a strong reason immediately that it couldn't be maintained same-origin.

This would be nice for actions or clicks that load a new page and then perform a user activation gated operation on the new page content. Examples:

• Open PIP for a video on the next page with a single button.
• Submitting an LLM request and playing a vibrate haptic on the next page as it streams in.
• Showing a payment request during a shopping flow.

If I understand correctly, there may already be prior art for this with playing video on page load.

[zcorpan]

Text fragments have some mechanism to make scrolling to text fragment work if the was a transient user activation from the previous document.

I think browsers have some heuristics to allow video autoplay on page load, but IIRC it's not simply checking if there was a user activation from the previous page. Formalizing how this works may be good though.

It's not clear to me that we want to allow fullscreen or window.open after a navigation. These are security-sensitive.

It's also not clear that this should be tied to the use of cross-document View Transitions.

[josepharhar]

@mustaqahmed

[mustaqahmed]

I share @zcorpan's concerns about carrying user-activation across a navigation. For example, a malicious site could carefully call sensitives APIs (popup, fullscreen etc) BOTH before and after the navigation to bypass the once-per-activation restriction.

[nickcoury]

If the navigation is same-origin, isn't that still equivalent to the malicious site turning the hard navigation into a soft navigation and doing the same thing? It doesn't feel on the surface like this increases the surface area of that concern significantly even if it lowers the effort for it.

[mustaqahmed]

The conclusion reached in whatwg/html#11328 is that carrying transient user activation sounds scary even for same-origin navigations but carrying sticky activation across same-origin seems fine.

[mustaqahmed]

Chrome feature request: https://crbug.com/433729626

[mustaqahmed]

Demo: https://vmpstr.github.io/htmldemos/activation/a.html

Requests for standard position: mozilla/standards-positions#1295 and WebKit/standards-positions#547