There are many problems regarding this idea, specially security for the user, this is why it's hard to convince the people of the benefits for RTS and FPS games.
For completeness here is the Firefox bug tracking this: https://bugzilla.mozilla.org/show_bug.cgi?id=633602
Why not re-capture only when the user clicks on the game again? In fact, I don't think the permission bar is needed at all, it would be implicitly given by clicking.
Of course, ESC should always work. Which would actually work fine for most games, since ESC presents a menu where the pointer isn't supposed to be frozen anyway.
I get why something with this effect is necessary if we are to have FPS games running in the browser, I just don't think that it's a good idea to allow websites to do so without explicit user permission. Admittedly, there are few things I hate as much as programs moving my mouse around, so I'm a bit biased.
My main concern is number overflow for long-running applications, but I seriously doubt this will be a problem for anyone.
I don't see any security problems with the proposed solution (though I don't claim to be a security expert!).
However, the comment about the cursor moving to the centre of the screen is an implementation detail. At least on Windows, you need to centre the mouse cursor for something like this because the OS won't (easily) give you actual virtual coordinates.
I think we are pretty safe on that part, even for veery long running app.
- Infinite dragging of a particular element; for example, scrolling in Google Maps or the sort of 'click and drag' UI of a typical billiards or mini-golf game.
- Relative movement events in general, as used for 'mouse-look' in FPS games.
For the first use-case, it should be pretty easy to deal with. Add a property to the 'mousedown' event called 'relativeMode' (or whatever), initially set to false. If the event-handler sets 'relativeMode' to true, then instead of sending the usual string of 'mousemove' events to elements the cursor moves over, the browser should capture ("freeze") the mouse, hide the cursor, and deliver 'mousedelta' events to the original element (whose x and y properties contain the movement delta from the location of the original mousedown event). When the user lets go of the mouse button, the browser releases the capture and shows the cursor. There's no security issue, because the user is in control of the capture at all times, and can just release the mouse button whenever they want.
The second use-case is a bit more troublesome, but as the Chrome bug linked elsewhere in this thread mentions, "web-pages in full-screen mode effectively own the cursor anyway". Perhaps a similar 'relativeMode' property could be added to the 'fullscreen' event.
That way, the user has full control over their mouse and you can also develop fps games.
Deltas are necessary but are only part of the solution.
(stolen from Jon Von Neumann's famous random number quote)