Restrict Gamepad usage

Category: Device
Type: New or changed feature
Status: Enabled by default (Chrome 103)
Intent stage: Prepare to ship

Summary

Requires a secure context for the Gamepad API and adds a feature policy to allow restricting gamepad use.

Motivation

The Gamepad API has been around for awhile and is widely used. However, recent pushes for privacy have brought the possibility for this API to be used for finger printing to our attention. These changes mitigate the finger printing risk.

Standards & signals

Specification: https://www.w3.org/TR/gamepad
Firefox: In development — 25 of August 2020 (Firefox 81): .getGamepads() will only return game pads if called in a secure context. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/getGamepads 22 of September 2020 (Firefox 82): switch to requiring a permission policy for third-party contexts.
Safari: No signal
Web developers: Strongly negative — Chris from Megapixel VR asked not to restrict to secure contexts due to breaking locally hosted (but not localhost) services and the use of self-signed certificates.
Tracking bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1314560

Docs: https://docs.google.com/document/d/1Dj_7EpT9ttnI96BuNXtLEJkHEq0orHgoLeYaOBz9xsU/edit?usp=sharing

Explainers: https://github.com/w3c/gamepad/pull/112 https://github.com/w3c/gamepad/pull/120

View on chromestatus.com