Skip to content

Update index.bs #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
toreini wants to merge 1 commit into
base: main
Choose a base branch
from
+14 −0
Open

Update index.bs #74

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -803,6 +803,20 @@ Access to the language detector API is gated behind the [=policy-controlled feat

Please see [[WRITING-ASSISTANCE-APIS#privacy]] for a discussion of privacy considerations for the translator and language detector APIs. That text was written to apply to all APIs sharing the same infrastructure, as noted in [[#dependencies]].


<h3 id="iframe-privacy"> Permissions policy, iframes, and workers </h3>
Copy link
Copy Markdown
Collaborator

@michaelwasserman michaelwasserman May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The spec's translator-permissions-policy section already covers permissions policy integration.


By default, these APIs are only available to top-level `Window`s, and to their same-origin iframes. Access to the APIs can be delegated to cross-origin iframes using the [Permissions Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Permissions_Policy) `allow=""` attribute:

<xmp class="idl">
<iframe src="https://example.com/" allow="translator language-detector"></iframe>
</xmp>

These APIs are currently not available in workers, due to the complexity of establishing a responsible document for each worker in order to check the permissions policy status. See [this discussion](https://github.com/webmachinelearning/translation-api/issues/18#issuecomment-2705630392) for more. It may be possible to loosen this restriction over time, if use cases arise.
Copy link
Copy Markdown
Collaborator

@michaelwasserman michaelwasserman May 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This text is already in the explainer, and the spec includes the correct Exposed=Window scope in the interface definitions.

I don't think this prose about workers and extensions is strictly needed in the spec, and isn't quite appropriate in the current form. Maybe a shorter <note> linking #18 would be appropriate.


Note that although the APIs are not exposed to web platform workers, a browser could expose them to extension service workers, which are outside the scope of web platform specifications and have a different permissions model.


<h2 id="security">Security considerations</h2>

Please see [[WRITING-ASSISTANCE-APIS#security]] for a discussion of security considerations for the translator and language detector APIs. That text was written to apply to all APIs sharing the same infrastructure, as noted in [[#dependencies]].
Loading