Feature Policy for Clipboard API

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 85)
Intent stage: Evaluate readiness to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Incubation
Web Platform Tests: Yes

WPT details: Tests are included in https://crrev.com/c/2164248, under //third_party/blink/web_tests/external/wpt.

Summary

Adds a feature policy (aka permission policy) flags for the Clipboard API. The flag names will be ‘clipboard-read’ and ‘clipboard-write’, to be consistent with the Clipboard API permissions, as feature policy is now merged with permissions and renamed to permissions policy.

Motivation

Secure the clipboard from unauthorized or unexpected use by iframes.

Standards & signals

Specification: https://github.com/w3c/clipboard-apis/pull/120
Firefox: No signal
Safari: No signal
Web developers: No signals
Tracking bug: https://crbug.com/1074489

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=feature-policy-for-clipboard-api
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Feature%20Policy%20for%20Clipboard%20API
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Feature%20Policy%20for%20Clipboard%20API
Baseline status: https://webstatus.dev/?q=Feature%20Policy%20for%20Clipboard%20API

View on chromestatus.com