Reprise: The Gamepad API works in Chrome but not in Firefox?

mkohler · January 7, 2022, 8:43pm

Yes, the Gamepad API in Firefox is only available in secure contexts, so you’d need to have HTTPS. This is according to specification.

See also the related issue for the spec here:

github.com/w3c/gamepad

Please don't restrict to a secure context

opened 06:43PM - 05 Mar 21 UTC

closed 12:38AM - 22 Feb 24 UTC

cbyrnemvr

Hi there, we've recently seen reports, by way of various browser consoles, that …the Gamepad API will soon require a secure context. It wasn't exactly clear on how to provide feedback on this change, although the Gamepad W3C spec mentions that GitHub issues are the preferred avenue for discussion. We understand that the reasoning for this change is to limit browser fingerprinting, and the general push/trend towards keeping things more secure/following best practices. Which we completely understand and agree with. However, there are applications where a secure context is not always possible. At least not without compromising security in some other way. Our products are network appliances which have a web management interface. Specifically one of these products is responsible for processing and managing extremely large LED displays (like you see in stadiums, rock concerts, side of buildings, etc). Our application leverages the awesome Gamepad API to allow our technicians to quickly navigate and adjust display uniformity via a gamepad controller. This works amazingly well. So thank you for your work on getting this standardized! Problem is that these devices live on temporary private networks with statically assigned IP addresses. Many of which have no internet connectivity at all. To further complicate things, all of the devices connected to these processors are either personally owned, provided by third party contractors, or rented from a general equipment warehouse. Meaning that not only do we lack access to the general internet certificate infrastructure, we're also not even able to deploy our own root certificates. Leaving us with the only option of using self signed certificates, and eventually teaching our industry to ignore certificate errors altogether. Which then means that the requirement to use a secure context actually lessened general security as we teach users to just ignore the scary certificate errors. I for one would like to avoid living in that world, so humbly request for a reconsideration of the requirement for the Gamepad API to only be accessible via a secure context. If the main concern is purely fingerprinting. It seems like the current requirement of having the user interact with the gamepad first before it is accessible via the page already largely helps prevents general catch-all/flyby fingerprinting? but we understand that's likely many other factors at play here. As an aside; there seem to be many other users adversely affected by this change (some noted as mentions in #120). Although curiously we did not see an issue already logged for this? So here we are. Thanks, Chris Byrne Software Engineer Megapixel VR https://megapixelvr.com/

Topic		Replies	Views
The Gamepad API works in Chrome but not in Firefox? Firefox Development	6	5979	March 8, 2022
How to create an enhancement request for the Gamepad API? Developer Community	1	782	January 7, 2022
Please don't restrict gamepads to a secure context Firefox Development	0	481	January 16, 2022
Is there a "generic" gamepad event for "SOMETHING happened"? Developer Community	2	1129	January 7, 2022
Gamepad input - "Autoplay is only allowed when approved by the user" Firefox Development feedback , issue	0	791	December 30, 2022

Reprise: The Gamepad API works in Chrome but not in Firefox?

Related topics