Skip to content

Editorial: ARIA Notify security prose, intro, and i18n example #2869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
daniel-montalvo wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Editorial: ARIA Notify security prose, intro, and i18n example #2869

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f886cb1
ARIA Notify security prose, intro, and i18n example
daniel-montalvo Aug 19, 2026
dfbf6f2
Update index.html
daniel-montalvo Aug 20, 2026
48a3941
Update index.html
daniel-montalvo Aug 20, 2026
c742afb
Update index.html
daniel-montalvo Aug 20, 2026
793ef9d
Update index.html
daniel-montalvo Aug 20, 2026
22a4e38
Make he security concern explicit
daniel-montalvo Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 28 additions & 2 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16856,6 +16856,9 @@ <h2>Interface Mixin <dfn>ARIAMixin</dfn></h2>
</section>
<section id="ARIANotifyMixin" class="normative" data-dfn-for="ARIANotifyMixin" data-link-for="ARIANotifyMixin">
<h2>Interface Mixin <dfn>ARIANotifyMixin</dfn></h2>
<p>
The ariaNotify API allows authors to provide notifications for accessibility. The <code>ariaNotify</code> method accepts a string as a first parameter and a configuration object as a second (optional) parameter.
</p>
<pre class="idl" data-cite="webidl">
enum AriaNotifyPriority { "normal", "high" };

Expand All @@ -16868,7 +16871,26 @@ <h2>Interface Mixin <dfn>ARIANotifyMixin</dfn></h2>
Element includes ARIANotifyMixin;
Document includes ARIANotifyMixin;
</pre>

<p>Since ariaNotify does not have a parameter to specify the language of the notification, the notification inherits that of its containing element</p>
<p>For cases where the language of the notification differs from that of its containing element, authors can use a separate container element and add language markup to convey the language.</p>

@smhigley smhigley Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: this isn't really a containing/container element, I think. It seems more appropriate to call it the source element or the calling element, since ariaNotify is a method and not a child or descendant.

<aside class="example">
<p>
The original page language is English, but there is a notification in Spanish.
</p>
<!-- ReSpec needs these examples to be unindented. -->

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But they are indented.

<pre class="example highlight html">

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This example could be more terse, and might be easier to read if there is a generated element.

Something like:

// To create a one-off notification that doesn't match the 
// language of the page or any other existing element, authors 
// could append a dynamically created courier element.

var courier = document.createElement('div')
courier.setAttribute('lang', 'es');
document.body.appendElement(courier);
courier.ariaNotify('Este texto debería leerse con la voz en español');

Note: I did not test the syntax above. Please verify if you decide to use this.

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For clarity, this is a suggestion, but the longer existing example is fine if the WG prefers. (I have no objection to disregarding my suggestion here.)

@smhigley smhigley Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would be document.body.appendChild(el), but otherwise it looks good to me! In my very subjective view, I also like this approach better / it feels closer to what I'd do in practice, but the example below also 100% works.

&lt;p&gt;Text in English, the original language of the page.&lt;/p&gt;
&lt;span class="spanish-notification" lang="es"&gt;&lt;/span&gt;
&lt;button class="spanish-notification-trigger"&gt;Spanish notification trigger&lt;/button&gt;
&lt;script&gt;
document.ariaNotify('some text string that inherits the English language defined on the html element');
const spanishElement = document.querySelector('.spanish-notification');
const spanishElementTrigger = document.querySelector('.spanish-notification-trigger');
spanishElementTrigger.addEventListener('click', () =&gt; {
spanishElement.ariaNotify('Este texto debería leerse con la voz en español');
});
&lt;/script&gt;
</aside>
<p>
The User Agent processing steps for the
<code><dfn data-df-type="method" data-dfn-for="ARIANotifyMixin">ariaNotify</dfn>(<var>announcement</var>, <var>options</var>)</code>
Expand Down Expand Up @@ -17258,7 +17280,11 @@ <h2>Example IDL Attribute Usage</h2>
</section>
<section class="informative" id="security-considerations">
<h2>Security Considerations</h2>
<p>This specification introduces no new security considerations.</p>
<p>
The <a>"aria-notify"</a> permissions policy has a default allowlist of "*". This relaxes the Permission Policy default because requiring embedders to opt in for each frame would leave announcements coming

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm don't recall why this decision was made... Is it worth an editorial note pointing to prior discussions, or explaining why? I've never seen Live Regions abused in an ad frame, so maybe that's the reason? If theres a direct link to tjhis detail in the explainer or discussion, should it be listed or linked here?

from third-party content inaccessible by default. Cross-origin embedded content can invoke this user-facing channel without explicit delegation, which can cause uncontrolled disruption for uses of assistive technologies. Authors who want tighter control can still restrict the "aria-notify" policy explicitly, for example with

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And there is is nothing stopping implementations from restricting this for untrusted sources, right? If not, we could mention that as a "UAs SHOULD/MAY" in the spec.

<code>&lt;iframe allow="aria-notify 'none'"&gt;</code> or <code>Permissions-Policy: aria-notify=(self)</code>.

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be seen as prioritizing author ease over AT users re: Priorities of Constituencies?

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though that's not really a Security risk... It's more just a "user annoyance" pester risk.

@cookiecrook cookiecrook Aug 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But if ariaNotify is mentioned in this context, should Live Regions be mentioned, too?

</p>
</section>
<section class="informative" id="privacy-considerations">
<h2>Privacy Considerations</h2>
Expand Down