search

WICG / digital-credentials

Digital Credentials, like driver's licenses
https://wicg.github.io/digital-credentials/
Other
82 stars 9 forks source link

Consider applying the robustness principle with regard to user agent request validation #100

Open tplooker opened 7 months ago

tplooker commented 7 months ago

For those unfamiliar with this principle, it boils down to

be conservative in what you do, be liberal in what you accept from others". It is often reworded as: "be conservative in what you send, be liberal in what you accept"

With regard to this API I would suggest the user agent / browser apply this philosophy when considering whether to, or how to perform request validation, to the extent it makes sense.

For example it may make sense for the browser to validate parts of a request to ensure it is well formed syntax wise, which might have certain developer ergonomic benefits and or security benefits, I do think this needs to be carefully analysed though and not just assumed the whole request must be strictly validated. Furthermore, I think it would be a mistake and would severely limit future extensibility if the user agent were to strictly validate the request, that is, in the event the browser receives a request which contains elements it doesn't understand, it shouldn't error, fail to forward the request to a wallet or only forward the request to the wallet with known request elements.

tlodderstedt commented 7 months ago

@tplooker thanks for filing this issue. My biggest concern is that implementers of a credential exchange protocol need to wait for browser vendors to adjust their software before they can rollout extensions/modifications to the credential exchange protocol. That's not just a technical and timing but essentially also a governance question.

We need to find the right balance between robustness and flexibility for implementers.

RByers commented 7 months ago

Agreed, and it's been part of Chrome plans from the start, though framed as enabling competition and choice in credential formats. I've tried to capture this more explicitly in a new explainer with:

By separating the act of requesting from the specific protocol, we can enable flexibility and adaptability in both the protocol and credential formats. This way, the pace of changes in browsers won't hinder progress or block new developments.

Feedback / suggestions on better wording appreciated.

hlflanagan commented 6 months ago

Suggest reviewing https://datatracker.ietf.org/doc/rfc9413/ to see how it might apply to this issue and the spec text.