search

w3c / webauthn

Web Authentication: An API for accessing Public Key Credentials
https://w3c.github.io/webauthn/
Other
1.19k stars 178 forks source link

Align RP ID string types #2074

Closed emlun closed 4 months ago

emlun commented 6 months ago

rp.id in PublicKeyCredentialCreationOptions and rpId in PublicKeyCredentialRequestOptions represent the same thing, but with different types. The WG agreed on the 2024-05-15 call that both should be USVString. Strictly speaking this is a breaking change (changing a type bound in input (contravariant) position to be more restrictive), but in practice this shouldn't be able to break any applications since then those credentials wouldn't have worked in get() anyway.

Fixes #2066.

Preview | Diff

MasterKale commented 4 months ago

From the WG @ 7/10: I don't have an objection to making this change, but it will mean that PublicKeyCredentialRequestOptionsJSON will define a combination of DOMString and USVString strings. We're exploring whether or not we need to update all DOMString in ...JSON dictionaries to USVString

MasterKale commented 4 months ago

Alternative strategy: define a PublicKeyCredentialRpEntityJSON that specifies DOMString so all the ...JSON dictionaries specify a consistent type for strings.

emlun commented 4 months ago

2024-07-10 WG call: We'll revert the change to PublicKeyCredentialRequestOptionsJSON and add PublicKeyCredentialRpEntityJSON as described above.

emlun commented 4 months ago

I made the changes discussed on last week's WG call, but doing that made me question if this was actually the correct resolution. I now believe it is not, and I propose abandoning this PR in favour of the alternative resolution in #2098. See #2098 for expanded discussion and rationale.