Chrome 110 Changes How Web Share API Embeds Third Party Content

Chrome 110, scheduled to roll out on February 7, 2022, comprises a change to the way it handles the Web Share API that improves privateness and safety by requiring a the Web Share API to explicitly enable third-party content material.

This won’t be one thing that a person writer must act on.

It’s in all probability extra related on the developer aspect the place they’re making issues like internet apps that use the Web Share API.

However, it’s good to know what it’s for the uncommon scenario when it is likely to be helpful for diagnosing why a webpage doesn’t work.

The Mozilla developer web page describes the Web Share API:

“The Web Share API permits a website to share textual content, hyperlinks, information, and different content material to user-selected share targets, using the sharing mechanisms of the underlying working system.

These share targets usually embody the system clipboard, e mail, contacts or messaging functions, and Bluetooth or Wi-Fi channels.

…Be aware: This API shouldn’t be confused with the Web Share Goal API, which permits a web site to specify itself as a share goal”

enable=”web-share” Attribute

An attribute is an HTML markup that modifies an HTML component ultimately.

For instance, the nofollow attribute modifies the <a> anchor component, by signaling the major search engines that the hyperlink just isn’t trusted.

The <iframe> is an HTML component and it may be modified with the enable=”web-share” attribute

An <iframe> permits a webpage to embed HTML, normally from one other web site.

Iframes are in all places, similar to in ads and embedded movies.

The issue with an iframe that comprises content material from one other website is that it creates the potential of exhibiting undesirable content material or enable malicious actions.

And that’s the issue that the enable=”web-share” attribute solves by setting a permission coverage for the iframe.

This particular permission coverage (enable=”web-share”) tells the browser that it’s okay to show third social gathering content material from inside an iframe.

Google’s announcement makes use of this instance of the attribute in use:

<iframe enable="web-share" src="https://third-party.instance.com/iframe.html"></iframe>

Google calls this a “a potentially breaking change in the Web Share API.”

The announcement warns:

“If a sharing motion must occur in a third-party iframe, a current spec change requires you to explicitly enable the operation.

Do that by including an enable attribute to the <iframe> tag with a worth of web-share.

This tells the browser that the embedding website permits the embedded third-party iframe to set off the share motion.”

Learn the announcement at Google’s Chrome webpage:

New requirements for the Web Share API in third-party iframes

Featured picture by Shutterstock/Krakenimages.com