why is the fullscreen api restricted?

the fullscreen api allows malicious websites to mimic the webbrowser's and operating system's ui. while this may be visible for experienced users, novice computer users may not be able to distinguish the fake ui and the real one. this effect is even more pronounced on mobile operating systems, where the system ui is quite sparse and very predictable.

a potential attack could be to render a normal website/game upon going to fullscreen, but also mimic the browser chrome. when the user enters a new url or opens a new tab, the content and the browser/os ui is then under full control of the attacker.

for instance, the website may send you an email, and then fake your gmail web interface login, green padlock and all, to steal your email credentials. advanced attacks could even go into an normal full screen (without any ui) and offer a fake "end fullscreen" button.

for these reasons, web browsers limit the fullscreen api with a per-origin configuration. typically, upon going to fullscreen for the first time, the browser asks you if it is ok. if you confirm, the web browser allows the origin to enter full screen without a feedback next time.

an additional common restriction is that fullscreen can not be entered upon page load, but requires a user interaction.

why is https required to maintain the restriction?

assume there is a popular game site that uses the fullscreen api via http. then there is an obvious security hole: every attacker on your route to the internet can go into fullscreen by redirecting any unencrypted request to that website, and then rendering their own attacker code.

while it's rare (but certainly not impossible) for criminal attackers to run such an attack, there are multiple state-sponsored attackers who even try to fake tls certificates.

will videos, games, and all casual full screen web applications require htps too?

if you want your website to be accessible in networks with censorship and/or javascript injection attacks, you need to use https anyways.

since that it doesn't cost anything to obtain a tls certificate and the overhead of encryption is negligible and insecure websites will generate a browser warning in the near future, the answer is:

yes, all websites require https.