Should user gestures be curried between contexts?

[oliverdunk]

Chrome currently curries user gestures between contexts. For example, if runtime.sendMessage is called from a webpage that has user activation from a button click, the runtime.onMessage handler in the background context is invoked with a user gesture.

Should we align on this behavior, either by default or with an opt-in?

[nasreenkhannam]

Hello everyone ,
I’m Nasreen Khan, and I’m learning about user activation patterns in WebExtensions.

From my understanding, this issue is about whether a user gesture that happens in one context (for example: popup, content script, or options page) should also allow privileged actions in a different context like the background script.

Here are my thoughts:

1. Security & Predictability

If user gestures automatically carry across contexts, extensions might perform unexpected actions (like opening tabs or modifying windows) without the user clearly understanding why.
Keeping gestures isolated per context makes behavior more predictable and safer.

2. Developer Use-Cases

At the same time, some workflows need gesture currying.
Example:
A user clicks a button in the popup → background script needs that gesture to open a tab or start a download.
Without gesture forwarding, developers may have to duplicate logic or use hacky workarounds.

3. Possible Balanced Approach

Allow gesture currying only for trusted transition paths:

popup → background

options → background

Do not curry gestures from content scripts to background to avoid security risks.

Provide an explicit API, for example:
browser.userActivation.forward()
so developers intentionally choose when gestures should be forwarded.

4. Documentation

Clear documentation about:

which contexts support currying

which APIs require activation

how activation is consumed
would help developers avoid confusion.

I’d love to learn more from others on this topic and help refine the proposal. Thank you!