v151 · Web APIs · Permissions Policy
Typing Interrupt
A real iframe fires element.focus() every few seconds — the classic focus-stealing pattern that disrupts users typing in forms. Toggle focus-without-user-activation to allow or deny and watch whether the iframe can steal focus from your typing field.
Checking Permissions Policy support…
Permissions-Policy: focus-without-user-activation=
user's page
typing here
Type here — try to keep focus:
—
event log
what the policy controls
- allow (default): embedded code can call
element.focus()at any time — including during the user's keystrokes in an unrelated field - deny:
focus()calls from the embed are silently ignored unless they occur inside a user-activation handler (click, keypress) - This page drives a real iframe with the
allowattribute changed betweenfocus-without-user-activationandfocus-without-user-activation 'none'
code
<!-- Parent page header -->
<!-- Permissions-Policy: focus-without-user-activation=() -->
<!-- Or per-iframe via allow attribute: -->
<!-- Deny focus-stealing for an ad embed -->
<iframe src="https://ad.example/"
allow="focus-without-user-activation 'none'"></iframe>
<!-- Allow for a trusted first-party embed (default behaviour) -->
<iframe src="https://app.example/"
allow="focus-without-user-activation"></iframe>
<!-- Inside the iframe -->
// Blocked when policy denies it (no user activation):
setTimeout(() => inputEl.focus(), 3000);
// Always works (user activation present):
button.addEventListener('click', () => inputEl.focus());
see also
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗