Skip to content

Feature Policy warnings #453

Open
Open
@scott2b

Description

@scott2b

YouTube embeds (possibly others?) trigger a large number of "Feature Policy" warnings that seem to stem from the feature allow list set on the video iframe embed.

Feature policies are tweakable via the Feature-Policy response header

The iframe itself comes from the YouTube iframe embed API which sets a number of "allows" including, among others: autoplay, accelerometer, clipboard-write.

Because we are not setting the Feature-Policy header on CDN content, there is then a resulting discontinuity between what the YouTube API is allowing and what the page response headers are allowing, resulting in these warnings. Since the warnings result in the browser erring on the side of safety, they are not especially problematic, but are indicative of potential features that might be unlocked. In particular we may want to support autoplay -- it is not clear if any of the other features might be useful.

At this time, the YouTube iframe embed API does not seem to support tweaking the allow list. Thus, the fix to this would be either to allow all of these features via Feature-Policy header, or to generate our own iframe code without the API. (Note that simply modifying the allow list after the iframe is injected will not actually squelch these warnings.)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      pFad - Phonifier reborn

      Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

      Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy