Javascript doesn't have access to camera, sensors etc. any more

[joemarshall]

I'm running on the current notebook server at alpha.iodide.io

What I Did

Try accessing the accelerometer in javascript (or camera etc.)

What I Expected

It to work

What Happened

Exception due to feature policy

SecurityError: Failed to construct 'Accelerometer': Access to sensor features is disallowed by feature policy
[eval] (cell:2:11)

(if applicable) notebook that reproduces bug

https://alpha.iodide.io/notebooks/6529/

Reason is because of this code in iodide/server/notebooks/templates/notebook.html

note the 'allow' attribute.

<iframe
  id="eval-frame"
  src="{{ iframe_src|safe }}"
  sandbox="allow-scripts allow-same-origin allow-modals allow-popups allow-popups-to-escape-sandbox"
  allowfullscreen="true"
  allowvr="yes"
  allow="microphone"

It would be really nice if it had a way of adding things to the allow attribute somehow in notebooks. As an aside, this breaks the old example notebook for webcam access also https://alpha.iodide.io/notebooks/1478/

For camera, there's no real reason not to allow access to the camera as default, because browsers already ask for that permission when you use it. On the other hand, with the others I guess there's a need for some kind of UI to allow people to ask for extra permissions and/or to warn people that a notebook uses them when you first run it or open it.