From 56863eab818c62f7b493825665a5f376a6cadeb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Philip=20J=C3=A4genstedt?= Date: Mon, 29 Jun 2020 15:40:34 +0200 Subject: [PATCH] Link to `Permissions-Policy` header after renaming Follows https://github.com/w3c/webappsec-feature-policy/pull/379. --- fullscreen.bs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fullscreen.bs b/fullscreen.bs index de440f9..063e3ff 100644 --- a/fullscreen.bs +++ b/fullscreen.bs @@ -725,8 +725,8 @@ user agent or even operating system environment when fullscreen. See also the de

To enable content in a nested browsing context to go fullscreen, it needs to be specifically allowed via feature policy, either through the <{iframe/allowfullscreen}> attribute of the HTML <{iframe}> element, or an appropriate declaration in the <{iframe/allow}> attribute of the -HTML <{iframe}> element, or through a `Feature-Policy` HTTP header -delivered with the document through which it is nested. +HTML <{iframe}> element, or through a `Permissions-Policy` HTTP +header delivered with the document through which it is nested.

This prevents e.g. content from third parties to go fullscreen without explicit permission.