search

w3c / secure-payment-confirmation

Secure Payment Confirmation (SPC)
https://w3c.github.io/secure-payment-confirmation/
Other
113 stars 40 forks source link

[Spec] Correctly specify authenticatorSelection requirements #132

Closed stephenmcgruer closed 3 years ago

stephenmcgruer commented 3 years ago

These were previously incorrect specified as auth-time requirements, but they are actually registration time arguments. This was overlooked as the build action didn't fail on warnings by default. This commit also changes the action to fail in such cases.

Fixes #129

Preview | Diff

stephenmcgruer commented 3 years ago

(Still a draft as the actual links aren't fixed yet; testing that the build change actually fails the build)

stephenmcgruer commented 3 years ago

@rsolomakhin @ianbjacobs - residentKey and authenticatorAttachment are not auth-time arguments for WebAuthn. I suspect what you were trying to do was to record that Chrome's current implementation requires residentKey="required" and authenticatorAttachment="platform" at registration time - is that correct? Assuming so, that actually needs to go in the registration steps - I can do that in this CL too.

ianbjacobs commented 3 years ago

@stephenmcgruer, +1 to doing any clarifications you deem helpful. Moving the info to another part of the spec seems fine. Thank you.

stephenmcgruer commented 3 years ago

@rsolomakhin @ianbjacobs - properly specified the limitations, please take a look. Rouslan, please double-check I've listed these correctly.