IFRAME embed code requires additional attributes

[pjotrsavitski]

It seems that browsers have made changes what sort of APIs are allowed to be used from within an <iframe>. Disabling everything by default as described here.

This in term raises issues with any H5P type that requires usage of certain API's. The one that allows user to use a microphone and save the result as a file fails dues to that when being embedded. The error shown to the enduser is Access to microphone is not allowed due to page not being loaded using HTTPS (current working is not 100% correct but is something along those lines.

Chrome itself shown no errors or warning in the developer console, though Safari does mention that getUserMedia was called from a frame without correct 'allow' attribute.

The solution for this case is simple enough, adding allow="microphone; midi" to the iframe code. It might not be enough to cover the needs for all of the H5P content types (either current or one that could be created in future). Using allow="*" would allow everything and from any context. yet that could be considered a bit too permissive.