Feature policy integration

[marcoscaceres]

In #73, @marcoscaceres wrote:

So what if we added a feature policy to prevent third parties from accessing game pads unless the top-level document explicitly says it's ok? That would mitigate some of the privacy concerns and limit some of the damage.

There was consensus that it would be helpful.

[marcoscaceres]

Data to help us with decision making: https://www.chromestatus.com/metrics/feature/timeline/popularity/3054

[mrmcpowned]

Just to clarify, would the scenario be something like a webpage that embeds an iframe whose source is an external webpage that uses the Gamepad API?

[marcoscaceres]

@mrmcpowned, yes, correct... in which case the following would be needed by hosting site:

<iframe allow="gamepad" src="https://third-party.com"></iframe>

Or a HTTP header that says https://third-party.com is ok to use gamepad... I think it's something like:

Feature-Policy: gamepad https://third-party.com