Add `<meta name="responsive-embedded-sizing">` by kojiishi · Pull Request #12444 · whatwg/html

kojiishi · 2026-05-13T08:54:08Z

This adds <meta name="responsive-embedded-sizing"> as an immutable standardized name.

This is used by the CSS responsive embedded sizing flag.

At least two implementers are interested (and none opposed):
- Chromium: https://chromestatus.com/feature/5108373464547328
Tests are written and can be reviewed and commented upon at:
- https://wpt.fyi/results/css/css-sizing/responsive-iframe?label=master&label=experimental&aligned
Implementation bugs are filed:
- Chromium: https://crbug.com/418397278
- Gecko: https://bugzilla.mozilla.org/show_bug.cgi?id=2039202
- WebKit: https://bugs.webkit.org/show_bug.cgi?id=314714
Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
MDN issue is filed: In Chromium Documentation Tracker https://issuetracker.google.com/issues/511947520
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

/dom.html ( diff )
/infrastructure.html ( diff )
/semantics.html ( diff )

kojiishi · 2026-05-13T09:37:20Z

@chrishtr @bfgeek @annevk @zcorpan

mtrootyy · 2026-05-13T17:07:14Z

If either name, http-equiv, or itemprop is specified in meta element, then the content attribute must also be specified.
If "responsive-embedded-sizing" is specified to value of name attribute of mata element, what is specfied to value of content attribute of this meta element?

miketaylr · 2026-05-18T01:38:56Z

https://html.spec.whatwg.org/#the-meta-element

If either name, http-equiv, or itemprop is specified, then the content attribute must also be specified. Otherwise, it must be omitted.

But just below:

If a meta element has a name attribute, it sets document metadata.... If a meta element has no content attribute, then the value part of the metadata name-value pair is the empty string.

So meta with name and without content is allowed (but, imho it's a bit confusing for HTML to use must in "this must be specified, otherwise it must not be specified" instead of may?)

mtrootyy · 2026-05-18T09:26:19Z

If a meta element has no content attribute, then the value part of the metadata name-value pair is the empty string.

The above specifications are for user agents, not for authors.
Regardless of how the user agent processes it, author must comply with the following specifications.

If either name, http-equiv, or itemprop is specified, then the content attribute must also be specified.

kojiishi · 2026-05-25T07:20:07Z

@annevk can you help whether the content attribute is required or not? It looks to me that omitting is allowed from what @miketaylr quoted, but I'm not sure.

@mtrootyy wrote:

If a meta element has no content attribute, then the value part of the metadata name-value pair is the empty string.

The above specifications are for user agents, not for authors. Regardless of how the user agent processes it, author must comply with the following specifications.

If either name, http-equiv, or itemprop is specified, then the content attribute must also be specified.

noamr

(Unofficial as I'm not an approver and we need multi implementer support)
I think this PR does the right thing in a way that's concise and consistent enough.
Editorially I can't say about maintaining the outdated wording style of existing meta tag or moving forward.

noamr · 2026-05-28T19:01:42Z

+    <div algorithm>
+    <p>If a <code>meta</code> element is
+    <span data-x="node is inserted into a document">inserted into the document</span>,
+    the user agent must run the following algorithm:</p>


I think this wording style is outdated but will leave to @annevk whether this needs to be consistent with what's around it or with new style.

OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?

Follow based on how other meta elements are speced.

Thanks again, I read others and followed them. Can you check?

noamr · 2026-06-02T10:43:32Z

@kojiishi the tests link points to existing tests in wpt.fyi that are not marked tentative.
Is there good coverage for adding/removing the meta tag dynamically before is seen?

kojiishi · 2026-06-03T05:18:54Z

@noamr

the tests link points to existing tests in wpt.fyi that are not marked tentative.

I removed .tentative because the template of this PR requested me to do so, there's a CSS WG resolution, and the resolution is put in the CSS spec. With this discussion, I will make sure the CSS spec is updated. Was that too early?

Is there good coverage for adding/removing the meta tag dynamically before is seen?

Yes, I think so, though they're based on the previous understanding of the "immutable" in the CSS WG. Among the wpt tests:

meta-in-body tests <meta> appearing in <body>.
meta-afterr-head tests <meta> in after-head insertion mode.
dynamic-append tests appending <meta>.
dynamic-remove tests removing <meta>.
dynamic-write tests document.write.
dynamic-name-change tests changing the name attribute.

I'll update/add tests and Blink once this discussion is settled down.

noamr · 2026-06-03T12:57:25Z

+  <dfn data-x="concept-document-responsive-embedded-sizing">responsive embedded sizing</dfn>,
+  initially false.</p>


Suggested change

<dfn data-x="concept-document-responsive-embedded-sizing">responsive embedded sizing</dfn>,

initially false.</p>

<dfn export data-x="concept-document-responsive-embedded-sizing">responsive embedded

sizing</dfn>, initially false.</p>

Also perhaps add a note of where this is used.

Done, thanks, and added a note.

noamr · 2026-06-03T13:00:01Z

+    <div algorithm>
+    <p>If a <code>meta</code> element is
+    <span data-x="node is inserted into a document">inserted into the document</span>,
+    the user agent must run the following algorithm:</p>


OK I looked at other meta elements and you need to check for the name here. Are you ignoring the content? If so it's good to add a note.
Does changing the name attribute work? Is the matching case-sensitive?

Follow based on how other meta elements are speced.

mtrootyy · 2026-06-05T22:46:30Z

+     to true.<p></li>
+    </ol>
+    </div>
+   </dd>


The following needs to be specified for authors:

If value of name attribute is specified an ASCII case-insensitive match for "responsive-embedded-sizing", the value of content attribute must be specified the empty string.

noamr · 2026-06-11T09:41:38Z

WHATNOT notes/minutes:

Responsive Iframe Meta Tag Proposal: Noam Rosenthal introduced a proposal (PR 12444) to add a meta tag for responsive embedded sizing, which serves as an opt-in for parents to resize iframes. Luke questioned if domain-specific opt-ins are necessary, but Simon Pieters noted that CSP frame ancestors already provide existing protections. The group discussed whether the meta tag provides sufficient control over cross-origin information access, with Noam Rosenthal comparing the functionality to an explicit post-message opt-in.

Responsive Iframe Data Leakage Concerns: The group discussed potential privacy risks, specifically whether responsive iframes could allow an origin to infer information about a user (e.g., whether they are logged into a site) based on size changes. Emilio Cobos Álvarez noted that the CSS working group previously discussed these risks and deemed them manageable if the parent page manages the sizing. Simon Pieters raised concerns regarding how to handle navigations and potential data leakage between pages.

Responsive Iframe Implementation and Documentation: Luke suggested that browsers should provide console warnings if an iframe opts into this feature without appropriate frame ancestor restrictions. Noam Rosenthal committed to updating the security explainer for the PR and consulting with Koji to ensure privacy concerns are addressed. Philip Jägenstedt clarified that fence frames, while still present in Chromium code, are not currently being actively developed.

kojiishi · 2026-07-13T05:43:34Z

I got another feedback from our security folks to add allowed-origin attribute. The value syntax is similar to frame-ancestors, but also allows wildcard. Examples:

<meta name="responsive-embedded-sizing" allowed-origins="https://example.org/ https://example2.org/">
<meta name="responsive-embedded-sizing" allowed-origins="*">

/cc @emilio @smfr

This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8

This patch support the `allowed-origins` attribute of the `<meta>` element for responsively-sized iframes. The addition of this attribute is discussed with the security team, and is currently being discussed at WHATWG[1]. This attribute has the same syntax as CSP `frame-ancestors`, and that it reuses the underlying logic. It restricts the effect of `responsive-embedded-sizing` meta tag by the origin of the container. All the changes are under an experimental runtime flag. [1]: whatwg/html#12444 (comment) Bug: 418397278 Change-Id: I2af4c4d4e80e1a3efb8b52ad512f1493157d01b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084061 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Koji Ishii <kojii@chromium.org> Auto-Submit: Koji Ishii <kojii@chromium.org> Cr-Commit-Position: refs/heads/main@{#1663715}

This adds `<meta name="responsive-embedded-sizing">` as an immutable standardized name. This is used by the CSS [responsive embedded sizing flag]. [responsive embedded sizing flag]: https://drafts.csswg.org/css-sizing-4/#document-responsive-embedded-sizing-flag

kojiishi · 2026-07-21T02:07:58Z

This PR is updated to include the allowed_origins attribute mentioned above.

mtrootyy · 2026-07-21T16:51:26Z

add;

<dd><code data-x="attr-meta-allowed-origins">allowed-origins</code></dd>

kojiishi force-pushed the responsive-embedded-sizing branch from 4f63023 to 5d63e86 Compare May 13, 2026 09:09

kojiishi mentioned this pull request May 13, 2026

Responsively-sized iframes mozilla/standards-positions#1394

Open

annevk reviewed May 18, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from 5d63e86 to ad98ae3 Compare May 28, 2026 08:51

noamr reviewed May 28, 2026

View reviewed changes

Comment thread source Outdated

Comment thread source Outdated

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from ad98ae3 to 49c5445 Compare May 28, 2026 16:22

noamr reviewed May 28, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch 2 times, most recently from fe4fc74 to 615fb1c Compare May 28, 2026 17:34

noamr approved these changes May 28, 2026

View reviewed changes

noamr reviewed Jun 3, 2026

View reviewed changes

noamr self-requested a review June 3, 2026 13:00

kojiishi force-pushed the responsive-embedded-sizing branch from 615fb1c to 6404dc1 Compare June 5, 2026 17:59

mtrootyy reviewed Jun 5, 2026

View reviewed changes

annevk mentioned this pull request Jul 3, 2026

[css-sizing] Auto-resize iframes based on content w3c/csswg-drafts#1771

Open

kojiishi force-pushed the responsive-embedded-sizing branch from 6404dc1 to 43cbcf8 Compare July 13, 2026 06:21

noamr reviewed Jul 13, 2026

View reviewed changes

Comment thread source Outdated

kojiishi force-pushed the responsive-embedded-sizing branch from 43cbcf8 to 89778a0 Compare July 13, 2026 10:29

chromium-wpt-export-bot mentioned this pull request Jul 16, 2026

[iframe] Support allowed-origins attribute web-platform-tests/wpt#61344

Open

kojiishi force-pushed the responsive-embedded-sizing branch 2 times, most recently from e4ce4e4 to f06ac17 Compare July 21, 2026 02:00

kojiishi force-pushed the responsive-embedded-sizing branch from f06ac17 to 5d62624 Compare July 21, 2026 02:00

mtrootyy reviewed Jul 21, 2026

View reviewed changes

Comment thread source

mtrootyy Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add;

<dd><code data-x="attr-meta-allowed-origins">allowed-origins</code></dd>

noamr self-requested a review July 23, 2026 10:26

noamr added the agenda+ To be discussed at a triage meeting label Jul 23, 2026

noamr mentioned this pull request Jul 23, 2026

Meeting 47 for joint OpenUI-WHATWG/HTML-CSSWG task force on styleable form controls #12684

Closed

noamr closed this Jul 23, 2026

noamr reopened this Jul 23, 2026

mfreed7 mentioned this pull request Jul 23, 2026

Meeting 48 for joint OpenUI-WHATWG/HTML-CSSWG task force on styleable form controls #12715

Open

		<dfn data-x="concept-document-responsive-embedded-sizing">responsive embedded sizing</dfn>,
		initially false.</p>

Uh oh!

Conversation

kojiishi commented May 13, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kojiishi commented May 13, 2026

Uh oh!

mtrootyy commented May 13, 2026

Uh oh!

miketaylr commented May 18, 2026

Uh oh!

mtrootyy commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kojiishi commented May 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noamr left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr commented Jun 2, 2026

Uh oh!

kojiishi commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noamr commented Jun 11, 2026

Uh oh!

kojiishi commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

kojiishi commented Jul 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

kojiishi commented May 13, 2026 •

edited by pr-preview Bot

Loading

mtrootyy commented May 18, 2026 •

edited

Loading

noamr left a comment •

edited

Loading

kojiishi commented Jun 3, 2026 •

edited

Loading

kojiishi commented Jul 13, 2026 •

edited

Loading