credential-handler / authn.io

Credential Mediator Polyfill
https://github.com/w3c-ccg/credential-handler-api
Other
44 stars 8 forks source link

Audit all requests to authn.io and ensure no credentials (cookies) are sent #108

Open dlongley opened 2 years ago

dlongley commented 2 years ago

As an added security measure, we should ensure that no credentials (cookies) are sent to authn.io for any requests -- cookies (for browsers that need to use them to store credential handler registrations vs. local storage / indexeddb) should all just be stored locally and never leave the user's browser.