search

w3c / webappsec-credential-management

WebAppSec Credential Management
https://w3c.github.io/webappsec-credential-management/
Other
50 stars 38 forks source link

Add permissions-policy check for publicKey credentials #182

Closed equalsJeffH closed 2 years ago

equalsJeffH commented 2 years ago

If the CredentialRequestOptions supplied to the Request a Credential algorithm contains a object named publicKey then check that the responsible document is allowed to use the publickey-credentials-get policy-controlled feature.

This PR supersedes PR #138.

Fixes #136 Improves #135

Preview | Diff

equalsJeffH commented 2 years ago

I am thinking that we ought to land this PR before we land PR #181 so the latter PR can incorporate these changes (by rebasing onto main branch) because the changes in this PR are less invasive than those in PR 181.

equalsJeffH commented 2 years ago

I resolved the conflicts with main branch using the github UI (which did a merge-from-main it seems (sorry Nina if that was the wrong thing to do)).

I think this PR is ready to merge modulo the three outstanding questions (above) I have for @nina @jyasskin: https://github.com/w3c/webappsec-credential-management/pull/182/#discussion_r773393848 fix issue #184 in separate PR ? https://github.com/w3c/webappsec-credential-management/pull/182/#discussion_r773415912 which error to return is not allowed by policy? https://github.com/w3c/webappsec-credential-management/pull/182/#issuecomment-999091144 Merge this PR before PR #181 ?

equalsJeffH commented 2 years ago

Thanks @jyasskin for the corrections. I think this PR is now ready to land. Then, we need to complete PR #181, and then address issue #184 (as outlined in this https://github.com/w3c/webappsec-credential-management/pull/182#discussion_r773393848 above).