Comma separator in iframe allow attribute (deprecated)

This deprecation removes the ability to use "," as a separator between items in a permissions policy declaration (feature policy declaration) in an iframe tag. Developers should switch to ";" as the correct separator.

Motivation

Chrome currently recognizes a non-standard "," as a separator between items in an iframe "allow" attribute. This behaviour is an accidental side effect of the way that we parse the attribute using the same parser as the 'Feature-Policy' header. (Commas were allowed by the header parser to support concatenating multiple headers together, but the attribute was always specced to contain a single serialized policy.)

Specification

Editor's draft

Status in Chromium

Blink>FeaturePolicy


Deprecated (tracking bug) in:

  • Chrome for desktop release 87
  • Chrome for Android release 87
  • Android WebView release 87

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • In development
  • No signal
  • Shipped/Shipping
  • No signals

Owner

Last updated on 2020-10-28