WebAPI/Security/ScreenOrientation: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Created page with "Name of API: Screen Orientation Reference: bug 720794 bug 673922 Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/285ab0bebdad0b7d/...")
 
No edit summary
 
(2 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Name of API: Screen Orientation
== Screen Orientation ==


Reference: bug 720794 bug 673922
Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation


Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/285ab0bebdad0b7d/9b7ba31dc934014f
General use case: Prevent screen orientation from changing when playing a game utilizing device motion. Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback). API wise, this means detecting orientation and setting/locking orientation.


Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation
References:  
*{{bug|720794}}
*{{bug|673922}}
*Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/285ab0bebdad0b7d/9b7ba31dc934014f


Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)
Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)


Threat severity: low per https://wiki.mozilla.org/Security_Severity_Ratings
Threat severity: Low per https://wiki.mozilla.org/Security_Severity_Ratings
 
== Regular web content (unauthenticated) ==
Use cases for unauthenticated code: Prevent screen orientation from changing when playing a game utilizing device motion.  Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback).  API wise, this means detecting orientation and setting/locking orientation.
 
Authorization model for normal content: implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only
 
Authorization model for installed content: implicit for both
 
Potential mitigations: As mentioned, normal content can only set/lock orientation in fullscreen.  Only top-level content can set/lock.
 
== Trusted (authenticated by publisher) ==
Use cases for authenticated code: Same as unauthenticated
 
Authorization model: implicit
 
Potential mitigations: None


== Certified (vouched for by trusted 3rd party) ==
=== Permissions Table===
Use cases for certified code: Same as above


Authorization model: Same as above
{| border="1" class="wikitable"
! Type
! Use Cases
! Authorization Model
! Notes & Other Controls
|-
| Web Content || As per general case|| Implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only ||  Normal content can only set/lock orientation in fullscreen.  Only top-level content can set/lock.
|-
| Installed Web Apps || As per general case || Implicit ||
|-
| Privileged Web Apps ||  As per general case  || Implicit ||
|-
| Certified Web Apps ||  As per general case || Implicit ||
|}


Potential mitigations: None
[[Category:Web APIs]]
[[Category:Security]]

Latest revision as of 23:41, 1 October 2014

Screen Orientation

Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation

General use case: Prevent screen orientation from changing when playing a game utilizing device motion. Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback). API wise, this means detecting orientation and setting/locking orientation.

References:

Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)

Threat severity: Low per https://wiki.mozilla.org/Security_Severity_Ratings

Permissions Table

Type Use Cases Authorization Model Notes & Other Controls
Web Content As per general case Implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only Normal content can only set/lock orientation in fullscreen. Only top-level content can set/lock.
Installed Web Apps As per general case Implicit
Privileged Web Apps As per general case Implicit
Certified Web Apps As per general case Implicit