Mobile Orion location permissions do not behave like Safari

ajgraves

The Orion mobile app does not handle location permissions like Safari, meaning on a per-site basis. Once the app is given location permission, then it will always grant any site's location request. Safari prompts for every site that requests location.

Follow these steps to test what I mean:

Allow Orion access to your location while using the app once prompted
Visit permission.site, tap on the Location button, and note that it turns green with no prompt.
Visit mybrowserlocation.com and tap the "Show My Browser Location" button, observe that it gives you exact latitude and longitude of your location, without a prompt.

How it behaves in Safari:

Allow Safari access to your location while using the app
Visit permission.site, tap on the Location button, and note that Safari prompts you to allow or deny location. Refresh the page, and tap the Location button again, and note that you are again prompted to allow your location.
Visit mybrowserlocation.com and tap the "Show My Browser Location" button, observe that you are prompted to allow or deny permission to your location. Refresh the page and tap the button again, and you are again prompted for permission.

What I suggest

Allow per-site location permissions in Orion mobile, regardless of whether or not you have location access enabled for Orion, it should not automatically grant your location data to any site that wants it. This could be a privacy and/or security risk.
I would suggest that you take it a step further than Safari does, and not only ask for allow/deny, but offer to remember the user's choice. If remembered, the site will not prompt again. If not remembered, the user will be prompted each time location is requested by the site.

ajgraves

Coming up on the 1 year anniversary of this, wondering if there's any progress made towards this goal? I just tested the most recent version of iOS Orion and with location enabled in the settings, each individual page can automatically get your location, without the user being aware that location is being shared, nor receiving any prompt to allow location sharing.

Vlad

ajgraves Can you confirm any other browser able to implement this in the desired way?

Clef

Vlad The iOS version of Firefox does.

rckt

It’s the default behaviour to share the location access per site. It should not be enabled for all the websites once it’s shared with at least one website. It’s definitely a bug and a severe one.

Moreover, I can’t revoke the location access in the browser settings. It’s always on.

shebg626

Oddly, camera and microphone access are given on a per-site basis, but location access is universal. I thought it was a limitation of third-party browsers but every other browser I’ve used (Firefox, Chrome, DuckDuckGo, Brave) requires site permission for location.

It’s quite concerning that this bug seems to have existed for more than two years.

nrudnyk

Thanks for highlighting such an important thing. We'll going to look into it and report back when we addressed it properly.