The Clipboard in the Browser: What a Page May Read, Write and Ask For

Access to the clipboard is governed by a split between read and write, with reading being gated more tightly than writing. The Clipboard API Gives pages the ability to access the system clipboard, but the specifics of how that access works can be nuanced.

Reading from the clipboard requires a recent user interaction with the page, while writing expects a granted clipboard-write permission and a Click-gesture. The Clipboard API and events specification from the W3C says that a script cannot expose clipboard contents without the User’s explicit permission. Implementation of those user checks varies by browser.

The Clipboard API defines two Permissions API names: clipboard-read and clipboard-write. The asynchronous navigator.clipboard Methods for reading and writing data require the app or site has obtained clipboard access using one or both of these permissions.

Under the current model, navigator.clipboard.write or navigator.clipboard.writeText methods can write arbitrary content to the clipboard, Such as images and text. Pages can install event Listeners for beforecopy, copy, beforecut, and cut events to intercept those clipboard actions.

The Clipboard API has moved towards requiring user gestures as a condition of clipboard access. Page scripts that use Clipboard.writeText or Clipboard.write without a user gesture originating in the active frame will raise a DOMException if allowWithoutGesture is not set to true.

When a read or write operation happens without permission, the browser shows a prompt asking the user to allow access for the host of the Current document. The spec says that permission for clipboard access should be remembered on a per-origin basis, and incorporate the Hostname of the document associated with the script.

The W3C defines this in terms of a ClipboardPermissionDescriptor with an allowWithoutGesture field of boolean type. The allowWithoutGesture parameter Is false by default, which means the API requires a user gesture to invoke a clipboard operation. The descriptor of clipboard-write with allowWithoutGesture set as true is considered more permissive than one with the parameter as false.

That formal permission model still leaves some gaps around permissiveness. For example, MDN's documentation of navigator.clipboard.write includes the note that allowWithoutGesture is supported in Chrome, Edge, and Opera, but not yet in Firefox or Safari. MDN Web Docs also points out that some security guidelines from browser vendors have previously recommended against using allowWithoutGesture if possible.

Browser vendors have also imposed additional limits on clipboard access. Some past instances of clipboard abuse, such as pasting computer-generated secrets into login dialogs, or replacing clipboard content with malicious code, have made browsers particularly cautious about automatic access. MDN recommends that web pages using permission prompts should be careful to explain to users why clipboard access is needed, and limit the scope of their requests.

The rules on which clipboard item formats can be read and written are context-sensitive as well. Browser implementations don't sanitize all data On reading from the clipboard. Any MIME types that are handled by the system's clipboard pasting engine, such as text and images, should be Available. But when a page reads from the clipboard, that browser may choose to expose only specific formats and sanitize others. Developers can Specify which MIME types should be accepted as-is by passing an array of types to navigator.clipboard.read. On pasting, MIME types are subject To the browser's paste-cleaning policies and content blocklists, which apply even to content copied directly from the clipboard.

The Clipboard API treates clipboard-read and clipboard-write as separate concerns under permissions, but browsing from clipboard-read Can still be functionally more restrictive than browsing from clipboard-write. Transient user activation reduces the attack surface, but Automatic access for writes, even those intercepted by the page, opens risks of access without context.