<html>
    <head>
      <base href="https://bugs.webkit.org/">
    </head>
    <body>
      <p>
        <div>
            <b><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Supporting allow-top-navigation-by-user-activation to iframe sandbox"
   href="https://bugs.webkit.org/show_bug.cgi?id=182248#c7">Comment # 7</a>
              on <a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Supporting allow-top-navigation-by-user-activation to iframe sandbox"
   href="https://bugs.webkit.org/show_bug.cgi?id=182248">bug 182248</a>
              from <span class="vcard"><a class="email" href="mailto:fred.wang@free.fr" title="Frédéric Wang (:fredw) <fred.wang@free.fr>"> <span class="fn">Frédéric Wang (:fredw)</span></a>
</span></b>
        <pre>(In reply to Brent Fulgham from <a href="show_bug.cgi?id=182248#c6">comment #6</a>)
<span class="quote">> > If it's still working in current STP, then I would expect it to be available
> > in an upcoming release.
> > 
> > So, as long as it's working in current STP, it hasn't been regressed and it
> > just hasn't been in the branch used for shipping Safari (yet).

> For example, someone could try it in the Developer Seed published a week or
> so ago. That's the best metric for when you might expect to see it released.</span >

So I just tested the following pages:

- WPT test (allow user navigation) <a href="http://w3c-test.org/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation_by_user_activation-manual.html">http://w3c-test.org/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation_by_user_activation-manual.html</a> (it's manual, you must click the 'navigate the top page' to check the result)
- WPT test (forbid automatic navigation) <a href="http://w3c-test.org/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation_by_user_activation_without_user_gesture.html">http://w3c-test.org/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_top_navigation_by_user_activation_without_user_gesture.html</a>
- WebKit demos (several manual tests) <a href="https://webkit.org/demos/frames/sandboxing/">https://webkit.org/demos/frames/sandboxing/</a>
- Reporter's demo: <a href="http://rev.cbsi.com/corey/test/iframe/redirect/sandbox_allow-top-nav-by-user.html">http://rev.cbsi.com/corey/test/iframe/redirect/sandbox_allow-top-nav-by-user.html</a>

All of them work for me with Safari Tech Preview 48 on macOS (note that you may need to go to Safari's security preference in order to allow popups). With the latest Safari release (11.0.3) allow-top-navigation-by-user-activation does not have any effect so the fix has not been integrated yet.

Regarding Derek's test case, I understand that automatic redirect/popup should be blocked while top/parent/blank navigation by user click should work. This is what happens with Safari Tech Preview 48, except that the _blank popup is blocked (adding the allow-popups flag does allow such a popup). Chrome 64 behaves the same.</pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
    </body>
</html>