Follow up of immersive-web/webxr#517. I would like to propose a simple minimal mechanism for UAs to grant permission to enter immersive mode. This enables in-vr navigation, allowing VR and AR content to interlink other immersive content and for UAs to implement seamless transitions. Some of the valuable use cases previously discussed:

• Performance implications. Having different web pages load is sort of beneficial for not having to deal with offloading / onloading new models and environments or making your own interstitial. You can avoid frame drops by letting the browser handle the transition, and VR web pages load quick enough.
• Games that contains links to other games. Or links to friends' games.
• Personal blogs that link to affiliated VR sites or your friends blogs.
• Educational websites for a class, that link to the school's portal or other resources.
• User generated content linking to one another. Like Rec Room, VR Chat or Super Craft.
• Sponsored links. You have a VR world about photography and film-making that links to Photorama, B&H, GoPro's VR portals.
• Content portals in general (directories of games, immersive videos, collections).
• Personal storefronts that link to products hosted by eBay VR, Amazon VR. A page could easily link to product 3D models hosted externally in services the like of Sketchfab or Google Blocks.
• AR browsers where pages always present at load to display virtual objects in context.
• Open in immersive mode A browser in 2D mode could offer the possibility to open a link in immersive mode immediately.

To enable previous scenarios I can think of two different spec approaches:

1. Implicit, without any additional API. The spec could describe scenarios where entering immersive mode is exempt of the user gesture requirement. Like for example a page navigated from another that was already presenting.

2. sessiongranted event. UAs can fire an event that explicitly allows content to enter immersive mode. The event handler is not subject to the user gesture requirement. This is how the API could look like:

navigator.xr.addEventListener('sessiongranted', function (evt) {
   // One could check for the type of session granted.
   // Events notifies of session creation after navigation, UA action, or requestSession.
   // The session object is provided as part of this event.
   if (evt.session.mode === 'immersive-vr') {
      // set up app state for immersive vr, if that's what the app wants
   } else {
      // notify user that this app only works in immersive vr mode, if desired
   }
}

The spec could also include guidelines covering scenarios where user's security and privacy can be compromised. A series of high level recommendations without getting into the specifics on how browsers would work as it's not in the spec scope

e.g: During navigation in immersive mode UAs must guide and keep the user informed at all times. Possible mechanisms are:

1. Interstitial. When navigation occurs the UA can present the user a screen with the destination URL and a button to continue or return to previous site.
2. Overlays. UAs control compositing and can always render information about the navigated page over content.
3. Modal dialog. User can invoke the browser UI at all times to consult info about the current site. UAs UI can also be modal (similar to Oculus or Steam home spaces) and invoked with a reserved button or interaction that cannot be listened by content. To prevent spoofing, UAs could additionally display personal information that user can recognize and pages don't have access to (user generated doodles or environment choices)
4. Fall back to windowed mode. Some UAs might decide to retain a more traditional flow and always fallback to windowed / 2D mode on navigation.

I recommend reading @toji explainer for additional context and previous thoughts on the topic.

I'm happy to volunteer to put together a more formal proposal after general agreement.

Ping to participants in previous conversation @AlbertoElias @blairmacintyre @cvan @lincolnfrog @modulesio @rcabanier @klausw @avaer @n5ro @kfarr @disregardfiat @AdaRoseCannon @TrevorFSmith @Artyom17