Mozilla feedback: Related Origins - Githubissues

w3c / webauthn

Web Authentication: An API for accessing Public Key Credentials

https://w3c.github.io/webauthn/

Other

1.19k stars 172 forks source link

Mozilla feedback: Related Origins #2186

Closed timcappalli closed 1 week ago

timcappalli commented 4 weeks ago

https://github.com/mozilla/standards-positions/issues/1052#issuecomment-2412388864

Addresses Mozilla's feedback around Related Origins.

Requires well-known to be served via HTTPS by the RP
Requires https: scheme for all well-known calls by the client
Requires https: for all redirects
Requires calls by client to well-known endpoint to not be credentialed and not include referrer

/ghcc @dveditz

The following tasks have been completed:

[ ] Modified Web platform tests (link)

Implementation commitment:

[ ] WebKit (link to issue)
[ ] Chromium (link to issue)
[ ] Gecko (link to issue)

Documentation and checks

[x] Affects privacy
[x] Affects security
[x] Updated explainer (link)

timcappalli commented 4 weeks ago

Spoke to @g-davidson offline (as he is unable to approve in Github for some reason) and he is OK with these changes.