Does the "script-closable" definition match reality?

[bzbarsky]

https://html.spec.whatwg.org/multipage/browsers.html#script-closable says the value is true if was created by a script (as opposed to by an action of the user).

Simple testcase, looks like this:

test.html: <a href="test2.html" target="_blank">Click me to open a popup window</a>

test2.html: <a href="test3.html">Navigate here</a>

test3.html: <button onclick='window.close()'>Click to close</button>

Trying that out in browsers shows they all allow closing the window via that window.close() call, though Edge prompts the user for permission before doing so.

[annevk]

See also https://www.w3.org/Bugs/Public/show_bug.cgi?id=28622.

[gterzian]

https://html.spec.whatwg.org/multipage/browsers.html#script-closable says the value is true if was created by a script (as opposed to by an action of the user).

Currently the spec also reads or if it is a top-level browsing context whose session history contains only one Document.

[annevk]

I don't understand the session history check it has today as it seems that the documents in there could be collected, leaving you always with one document in certain implementations.

It was also brought to my attention that with the increased adoption (and defaulting of) noopener the auxiliary browsing context check becomes less applicable. We probably need some flag on new top level browsing contexts that were created as part of noopener so they can still be closed via script. (This might already work in Chrome? Firefox is tracking this in https://bugzilla.mozilla.org/show_bug.cgi?id=1681457.)

[bzbarsky]

I think the intent of the session history check is that if a user opens a new window and then loads a page in it, that page should be able to close the window, since there is no data loss in some sense (because there is no other data). But really, I think that check was added there to match existing behavior of some browsers.

[annevk]

That use case makes sense, FWIW, but I think the current requirement relies on there being a bfcache that somehow always succeeds (as otherwise you would not get multiple Document entries).

[bzbarsky]

Oh, yeah, that part make no sense. Should refer to session history entries instead or something like that.