ARIA notify iframe restrictions

[aluhrs13]

What problem are you trying to solve?

Our proposal for ARIA Notify gives sites the ability to announce changes on the page to screen readers. We believe that we need to offer sites the ability to allow or deny iframes from accessing this API which would need an HTML solution.

What solutions exist today?

ARIA live regions solve similar problems, but not exactly. See linked explainer above for details.

How would you solve it?

We think adding allow-aria-notify as a sandbox option would be a good solution.

Anything else?

Not 100% sure this template was the right one for this. Feel free to redirect me 🙂

[domenic]

I think permissions policy is probably a better fit, as it doesn't require opting into the whole sandboxing infrastructure. What do you think?

[alisonmaher]

The goal would be for this to be allowed by default to ensure accessibility coverage, and then authors can disallow it as they see fit. Is that possible with permissions policy? I was under the impression that it was the opposite (disallowed by default, and authors allow as they see fit).

[domenic]

Yes, if you set a default allowlist of *, then authors can override that with <iframe allow="aria-notify 'none'"> or Permissions-Policy: aria-notify=(self).

[alisonmaher]

Ah I see, if we are able to make it allowed by default using *, then that approach sounds reasonable to me