What is 'browser geolocation API security' and what restrictions prevent silent location tracking?

Question

Accepted Answer

The Geolocation API (navigator.geolocation.getCurrentPosition()) requires: (1) Secure context (HTTPS or localhost - HTTP sites cannot access geolocation); (2) User permission prompt - the browser shows 'Allow [site] to access your location?' and the user must explicitly grant; (3) The permission can be 'Block' permanently or 'Allow once' or 'Allow while visiting the site'. Websites cannot access location silently. The Permissions Policy header (geolocation=()) can disable the API entirely for the page or specific iframes

Answer

Geolocation permission is granted automatically after the user logs in to a website

Answer

The geolocation API is freely accessible by any HTTPS website without restrictions

Answer

Geolocation is always available; the Permissions API only controls camera and microphone; notification and geolocation prompts can be pre-approved by the page via a meta tag to smooth onboarding; the Report-To endpoint receives CSP violations only after the user consents through a browser permission prompt; SRI applies to images and stylesheets only, with script tags excluded because their hashes change with compression; Content-Type sniffing is mandatory in the HTML spec, and X-Content-Type-Options: nosniff is an IE relic browsers ignore; prefetched pages execute their scripts in the background, meaning a prefetch alone can fire an XSS payload's network calls in every browser

What is 'browser geolocation API security' and what restrictions prevent silent location tracking?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is 'browser geolocation API security' and what restrictions prevent silent location tracking?

Where this fits in the Web App Fundamentals exam

More free Browser Security questions

One question down. Thousands to go.