search

w3c / webappsec-credential-management

WebAppSec Credential Management
https://w3c.github.io/webappsec-credential-management/
Other
50 stars 38 forks source link

Credential terminology and Fetch #12

Open annevk opened 8 years ago

annevk commented 8 years ago

11 made me realize that if "Credential" becomes a thing, the existing "credentials mode" of Fetch will be very confusing. Note that Request and fetch() already accept credentials member in a dictionary. Request also exposes it as a property.

Is it too late to use "Login" or some such instead of "Credential"?

mikewest commented 8 years ago

I think it is. I mean, we can change the name, but the goal is to be more generic than "Login".

annevk commented 8 years ago

Google has these synonyms to offer: "documents, documentation, papers, identity papers, bona fides, ID, ID card, identity card, passport, proof of identity; certificates, diplomas, certification, references"

I like BonaFides.

I'm not sure why this was not raised before. We've been using "credentials" to mean cookies, HTTP authentication, and TLS client certificates for a decade now.

mikewest commented 8 years ago

To be blunt, I don't want to have a 9-month long argument about naming with the "Credentials CG" folks again. :(

annevk commented 8 years ago

I don't really see why they would get to dictate the terms here. "Credentials" on the platform already happened and it means something else. If we start using it for two different things and route them through the same API that does not seem great at all.

mikewest commented 8 years ago

I don't mean that that group can dictate terms. I mean that we've had a seriously long and troubled discussion about naming, and this is where we ended up. I'm reluctant to reopen that can of worms, because it's full of worms. :)

annevk commented 8 years ago

Did this argument came up in that discussion?

It seems like poor form to dismiss something on the basis of something that happened in the past. (See: "sunk cost".)

wanderview commented 8 years ago

If we can make the new feature fit in with the existing platform system then the Credential name is not too bad. We can think of it as an extension of the existing credentials and not something completely separate.

Or maybe this really is more different than I realize... in which case the name might be contributing to my confusion.

mikewest commented 8 years ago

For the case of Fetch, I think this notion of "credential" and the existing notion of "credential" actually play pretty nicely together. That is, the same flag can be used for both in a relatively straightforward way. I've spelled out what I think that might look like in https://github.com/whatwg/fetch/pull/237.