From dd00aaddebd343397deb0ee804ee621fb2caaa16 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Wed, 5 Oct 2022 19:17:46 +0000
Subject: [PATCH] Merge pull request #1796 from w3c/issue-1794-broken-refs

SHA: 6b92f43960c1b8d23ec365b20d01bdbce47aa3f6
Reason: push, by @emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 147 +++++++++++++++++++++++++++--------------------------
 1 file changed, 74 insertions(+), 73 deletions(-)

diff --git a/index.html b/index.html
index 077ac4b6a..e3e21884a 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 44af0bf3e, updated Fri Jul 29 17:05:16 2022 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="e0d10dd63207720e1fb42f96515ab9fe2b442248" name="document-revision">
+  <meta content="6b92f43960c1b8d23ec365b20d01bdbce47aa3f6" name="document-revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -1346,11 +1346,10 @@ <h2 class="heading settled" data-level="3" id="sctn-dependencies"><span class="s
      <p><a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor">%ArrayBuffer%</a> is defined in <a data-link-type="biblio" href="#biblio-ecmascript">[ECMAScript]</a>.</p>
     <dt data-md>HTML
     <dd data-md>
-     <p>The concepts of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple" id="ref-for-concept-origin-tuple">tuple origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>,
-and <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal to</a> are defined in <a data-link-type="biblio" href="#biblio-html">[HTML]</a>.</p>
+     <p>The concepts of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context">browsing context</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin②">origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-tuple" id="ref-for-concept-origin-tuple">tuple origin</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object">relevant settings object</a>, <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site">same site</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal to</a> are defined in <a data-link-type="biblio" href="#biblio-html">[HTML]</a>.</p>
     <dt data-md>URL
     <dd data-md>
-     <p>The concept of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-same-site" id="ref-for-host-same-site">same site</a> is defined in <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
+     <p>The concepts of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port">port</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme">scheme</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain">valid domain</a> and <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string">valid domain string</a> are defined in <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
     <dt data-md>Web IDL
     <dd data-md>
      <p>Many of the interface definitions and all of the IDL in this specification depend on <a data-link-type="biblio" href="#biblio-webidl">[WebIDL]</a>. This updated version of
@@ -1691,27 +1690,27 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party-identifier">Relying Party Identifier</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rp-id">RP ID</dfn>
     <dd data-md>
-     <p>In the context of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑧">WebAuthn API</a>, a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier①">relying party identifier</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string">valid domain string</a> identifying the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑧">WebAuthn Relying Party</a> on whose behalf a given <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑤">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑧">authentication ceremony</a> is being performed. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑥">public key credential</a> can only be used for <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑨">authentication</a> with the same entity (as identified by <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③">RP ID</a>) it was registered with.</p>
+     <p>In the context of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑧">WebAuthn API</a>, a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier①">relying party identifier</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string①">valid domain string</a> identifying the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑧">WebAuthn Relying Party</a> on whose behalf a given <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑤">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑧">authentication ceremony</a> is being performed. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑥">public key credential</a> can only be used for <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑨">authentication</a> with the same entity (as identified by <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③">RP ID</a>) it was registered with.</p>
      <p>By default, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④">RP ID</a> for a
 WebAuthn operation is set to the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain">effective domain</a>. This default MAY be
 overridden by the caller, as long as the caller-specified <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤">RP ID</a> value <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">is a registrable domain suffix of or is equal
 to</a> the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①">effective domain</a>. See also <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> and <a href="#sctn-getAssertion">§ 5.1.4 Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>.</p>
      <div class="note" id="note-pkcredscope" role="note">
-      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin③">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
+      <a class="self-link" href="#note-pkcredscope"></a> Note: An <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑥">RP ID</a> is based on a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a> name. It does not itself include a <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a> or <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a>, as an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin③">origin</a> does. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑦">RP ID</a> of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑦">public key credential</a> determines its <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="scope">scope</dfn>. I.e., it <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">determines the set of origins on which the public key credential may be exercised</dfn>, as follows: 
       <ul>
        <li data-md>
         <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑧">RP ID</a> must be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to②">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain③">effective domain</a>.</p>
        <li data-md>
-        <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised②">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a> must be <code>https</code>.</p>
+        <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised②">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme②">scheme</a> must be <code>https</code>.</p>
        <li data-md>
-        <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised③">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a> is unrestricted.</p>
+        <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised③">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port②">port</a> is unrestricted.</p>
       </ul>
       <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>.</p>
       <p>This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, <a data-link-type="biblio" href="#biblio-rfc6265">[RFC6265]</a>).
     Please note that this is a greater relaxation of "same-origin" restrictions than what <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain" id="ref-for-dom-document-domain">document.domain</a>'s setter provides.</p>
       <p>These restrictions on origin values apply to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑤">WebAuthn Clients</a>.</p>
      </div>
-     <p>Other specifications mimicking the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑨">WebAuthn API</a> to enable WebAuthn <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑧">public key credentials</a> on non-Web platforms (e.g. native mobile applications), MAY define different rules for binding a caller to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier②">Relying Party Identifier</a>. Though, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⓪">RP ID</a> syntaxes MUST conform to either <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string①">valid domain strings</a> or URIs <a data-link-type="biblio" href="#biblio-rfc3986">[RFC3986]</a> <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
+     <p>Other specifications mimicking the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑨">WebAuthn API</a> to enable WebAuthn <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑧">public key credentials</a> on non-Web platforms (e.g. native mobile applications), MAY define different rules for binding a caller to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier②">Relying Party Identifier</a>. Though, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⓪">RP ID</a> syntaxes MUST conform to either <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string②">valid domain strings</a> or URIs <a data-link-type="biblio" href="#biblio-rfc3986">[RFC3986]</a> <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-public-key-credential-source">Server-side Public Key Credential Source</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential">Server-side Credential</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-resident-credential">Non-Resident Credential</dfn>
@@ -2047,7 +2046,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
     </dl>
     <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise②">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⓪">navigator.credentials.create()</a></code>.</p>
     <p class="note" role="note"><span>Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-reference" id="ref-for-dfn-get-buffer-source-reference">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -2083,11 +2082,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-create-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain④">effective domain</a>.
-If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑤">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain">valid domain</a>, then throw a
+If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑤">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain①">valid domain</a>, then throw a
 "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③">DOMException</a></code>.</p>
-      <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑥">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>, which can be represented in various manners,
-    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain①">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host">empty host</a>.
-    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain②">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host②">host</a> is allowed here. This is for simplification and also
+      <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑥">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host②">host</a>, which can be represented in various manners,
+    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain②">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host">empty host</a>.
+    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain③">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a> is allowed here. This is for simplification and also
     is in recognition of various issues with using direct IP address identification in concert
     with PKI-based security.</p>
      <li id="CreateCred-DetermineRpId">
@@ -2471,7 +2470,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
     </dl>
     <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise③">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code>.</p>
     <p class="note" role="note"><span>Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
-avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-reference" id="ref-for-dfn-get-buffer-source-reference①">get a copy of the bytes held
+avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy" id="ref-for-dfn-get-buffer-source-copy①">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
@@ -2518,11 +2517,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
 an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⓪">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a>.
-If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain①">valid domain</a>, then throw a
+If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain②">valid domain</a>, then throw a
 "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
-      <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
-    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain③">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
-    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain④">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a> is allowed here. This is for simplification and also is
+      <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a>, which can be represented in various manners,
+    such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain④">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
+    Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain⑤">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host⑤">host</a> is allowed here. This is for simplification and also is
     in recognition of various issues with using direct IP address identification in concert with
     PKI-based security.</p>
      <li id="GetAssn-DetermineRpId">
@@ -6186,7 +6185,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <p class="note" role="note"><span>Note:</span> In practice, several implementations do not implement steps four and onward of the
 algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid②">determining if a caller’s FacetID is authorized for an AppID</a>.
-Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-same-site" id="ref-for-host-same-site①">same site</a>.</p>
+Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site①">same site</a>.</p>
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
@@ -6238,7 +6237,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
 return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
-         <p class="note" role="note"><span>Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-same-site" id="ref-for-host-same-site②">same site</a>.</p>
+         <p class="note" role="note"><span>Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#same-site" id="ref-for-same-site②">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
        </ol>
@@ -6701,9 +6700,9 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
 </pre>
    </dl>
    <h2 class="heading settled" data-level="11" id="sctn-automation"><span class="secno">11. </span><span class="content">User Agent Automation</span><a class="self-link" href="#sctn-automation"></a></h2>
-   <p>For the purposes of user agent automation and <a data-link-type="dfn" href="#web-application" id="ref-for-web-application④">web application</a> testing, this document defines a number of <a data-link-type="biblio" href="#biblio-webdriver">[WebDriver]</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command">extension commands</a>.</p>
+   <p>For the purposes of user agent automation and <a data-link-type="dfn" href="#web-application" id="ref-for-web-application④">web application</a> testing, this document defines a number of <a data-link-type="biblio" href="#biblio-webdriver">[WebDriver]</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands">extension commands</a>.</p>
    <h3 class="heading settled" data-level="11.1" id="sctn-automation-webdriver-capability"><span class="secno">11.1. </span><span class="content">WebAuthn WebDriver Extension Capability</span><a class="self-link" href="#sctn-automation-webdriver-capability"></a></h3>
-   <p>In order to advertise the availability of the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command①">extension commands</a> defined below, a new <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability">extension capability</a> is defined.</p>
+   <p>In order to advertise the availability of the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands①">extension commands</a> defined below, a new <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability">extension capability</a> is defined.</p>
    <figure class="table" id="table-virtualAuthenticatorsWebdriverCapability">
     <table class="data">
      <thead>
@@ -6785,7 +6784,7 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
    </ol>
    <p>User-Agents implementing defined <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑤">authenticator extensions</a> SHOULD implement the corresponding <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities②">authenticator extension capability</a>.</p>
    <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authenticators"><span class="secno">11.2. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticators">Virtual Authenticators</dfn></span><a class="self-link" href="#sctn-automation-virtual-authenticators"></a></h3>
-   <p>These WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command②">extension commands</a> create and interact with <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②">Virtual Authenticators</a>: software implementations of the <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model③">Authenticator Model</a>. <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③">Virtual Authenticators</a> are stored in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticator-database">Virtual Authenticator Database</dfn>.
+   <p>These WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands②">extension commands</a> create and interact with <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②">Virtual Authenticators</a>: software implementations of the <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model③">Authenticator Model</a>. <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③">Virtual Authenticators</a> are stored in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticator-database">Virtual Authenticator Database</dfn>.
 Each stored <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators④">virtual authenticator</a> has the following properties:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorid">authenticatorId</dfn>
@@ -6822,7 +6821,7 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p class="note" role="note"><span>Note:</span> This property has no effect if the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">Virtual Authenticator</a> does not support the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method②">User Verification Method</a> extension.</p>
    </dl>
    <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-authenticator"><span class="secno">11.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-virtual-authenticator">Add Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-add-virtual-authenticator"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">Virtual Authenticator</a>. It is
+   <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">Virtual Authenticator</a>. It is
 defined as follows:</p>
    <figure class="table" id="table-addVirtualAuthenticator">
     <table class="data">
@@ -6938,7 +6937,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success">success</a> with data <var>authenticatorId</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual-authenticator"><span class="secno">11.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-virtual-authenticator">Remove Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-remove-virtual-authenticator"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-virtual-authenticator" id="ref-for-remove-virtual-authenticator">Remove Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command④">extension command</a> removes a previously created <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①④">Virtual Authenticator</a>.
+   <p>The <a data-link-type="dfn" href="#remove-virtual-authenticator" id="ref-for-remove-virtual-authenticator">Remove Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands④">extension command</a> removes a previously created <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①④">Virtual Authenticator</a>.
 It is defined as follows:</p>
    <figure class="table" id="table-removeVirtualAuthenticator">
     <table class="data">
@@ -6963,7 +6962,7 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -7106,7 +7105,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
 stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
@@ -7134,7 +7133,7 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -7162,7 +7161,7 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -7186,7 +7185,7 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.9" id="sctn-automation-set-user-verified"><span class="secno">11.9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="set-user-verified">Set User Verified</dfn></span><a class="self-link" href="#sctn-automation-set-user-verified"></a></h3>
-   <p>The <a data-link-type="dfn" href="#set-user-verified" id="ref-for-set-user-verified">Set User Verified</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑨">extension command</a> sets the <var>isUserVerified</var> property on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a>. It
+   <p>The <a data-link-type="dfn" href="#set-user-verified" id="ref-for-set-user-verified">Set User Verified</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands⑨">extension command</a> sets the <var>isUserVerified</var> property on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑧">Virtual Authenticator</a>. It
 is defined as follows:</p>
    <figure class="table" id="table-setUserVerified">
     <table class="data">
@@ -8931,6 +8930,14 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-relevant-settings-object④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-same-site">
+   <a href="https://html.spec.whatwg.org/multipage/origin.html#same-site">https://html.spec.whatwg.org/multipage/origin.html#same-site</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-same-site">3. Dependencies</a>
+    <li><a href="#ref-for-same-site①">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-same-site②">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-secure-context">
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context">https://html.spec.whatwg.org/multipage/webappapis.html#secure-context</a><b>Referenced in:</b>
    <ul>
@@ -9337,9 +9344,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-domain">
    <a href="https://url.spec.whatwg.org/#concept-domain">https://url.spec.whatwg.org/#concept-domain</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-domain">4. Terminology</a>
-    <li><a href="#ref-for-concept-domain①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-domain②">(2)</a>
-    <li><a href="#ref-for-concept-domain③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-domain④">(2)</a>
+    <li><a href="#ref-for-concept-domain">3. Dependencies</a>
+    <li><a href="#ref-for-concept-domain①">4. Terminology</a>
+    <li><a href="#ref-for-concept-domain②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-domain③">(2)</a>
+    <li><a href="#ref-for-concept-domain④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-domain⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-empty-host">
@@ -9352,9 +9360,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-url-host">
    <a href="https://url.spec.whatwg.org/#concept-url-host">https://url.spec.whatwg.org/#concept-url-host</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-host">4. Terminology</a>
-    <li><a href="#ref-for-concept-url-host①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-url-host②">(2)</a>
-    <li><a href="#ref-for-concept-url-host③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-url-host④">(2)</a>
+    <li><a href="#ref-for-concept-url-host">3. Dependencies</a>
+    <li><a href="#ref-for-concept-url-host①">4. Terminology</a>
+    <li><a href="#ref-for-concept-url-host②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-url-host③">(2)</a>
+    <li><a href="#ref-for-concept-url-host④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-concept-url-host⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-ipv4">
@@ -9381,26 +9390,30 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-url-port">
    <a href="https://url.spec.whatwg.org#concept-url-port">https://url.spec.whatwg.org#concept-url-port</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-port">4. Terminology</a> <a href="#ref-for-concept-url-port①">(2)</a>
+    <li><a href="#ref-for-concept-url-port">3. Dependencies</a>
+    <li><a href="#ref-for-concept-url-port①">4. Terminology</a> <a href="#ref-for-concept-url-port②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-url-scheme">
    <a href="https://url.spec.whatwg.org#concept-url-scheme">https://url.spec.whatwg.org#concept-url-scheme</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-url-scheme">4. Terminology</a> <a href="#ref-for-concept-url-scheme①">(2)</a>
+    <li><a href="#ref-for-concept-url-scheme">3. Dependencies</a>
+    <li><a href="#ref-for-concept-url-scheme①">4. Terminology</a> <a href="#ref-for-concept-url-scheme②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-valid-domain">
    <a href="https://url.spec.whatwg.org/#valid-domain">https://url.spec.whatwg.org/#valid-domain</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-valid-domain">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-valid-domain①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-valid-domain">3. Dependencies</a>
+    <li><a href="#ref-for-valid-domain①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-valid-domain②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-valid-domain-string">
    <a href="https://url.spec.whatwg.org/#valid-domain-string">https://url.spec.whatwg.org/#valid-domain-string</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-valid-domain-string">4. Terminology</a> <a href="#ref-for-valid-domain-string①">(2)</a>
+    <li><a href="#ref-for-valid-domain-string">3. Dependencies</a>
+    <li><a href="#ref-for-valid-domain-string①">4. Terminology</a> <a href="#ref-for-valid-domain-string②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-Grapheme_Cluster_Boundaries">
@@ -9430,19 +9443,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-dfn-extension-capability①">11.1.1. Authenticator Extension Capabilities</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="term-for-dfn-extension-command">
-   <a href="https://w3c.github.io/webdriver/#dfn-extension-command">https://w3c.github.io/webdriver/#dfn-extension-command</a><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="term-for-dfn-extension-commands">
+   <a href="https://w3c.github.io/webdriver/#dfn-extension-commands">https://w3c.github.io/webdriver/#dfn-extension-commands</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dfn-extension-command">11. User Agent Automation</a>
-    <li><a href="#ref-for-dfn-extension-command①">11.1. WebAuthn WebDriver Extension Capability</a>
-    <li><a href="#ref-for-dfn-extension-command②">11.2. Virtual Authenticators</a>
-    <li><a href="#ref-for-dfn-extension-command③">11.3. Add Virtual Authenticator</a>
-    <li><a href="#ref-for-dfn-extension-command④">11.4. Remove Virtual Authenticator</a>
-    <li><a href="#ref-for-dfn-extension-command⑤">11.5. Add Credential</a>
-    <li><a href="#ref-for-dfn-extension-command⑥">11.6. Get Credentials</a>
-    <li><a href="#ref-for-dfn-extension-command⑦">11.7. Remove Credential</a>
-    <li><a href="#ref-for-dfn-extension-command⑧">11.8. Remove All Credentials</a>
-    <li><a href="#ref-for-dfn-extension-command⑨">11.9. Set User Verified</a>
+    <li><a href="#ref-for-dfn-extension-commands">11. User Agent Automation</a>
+    <li><a href="#ref-for-dfn-extension-commands①">11.1. WebAuthn WebDriver Extension Capability</a>
+    <li><a href="#ref-for-dfn-extension-commands②">11.2. Virtual Authenticators</a>
+    <li><a href="#ref-for-dfn-extension-commands③">11.3. Add Virtual Authenticator</a>
+    <li><a href="#ref-for-dfn-extension-commands④">11.4. Remove Virtual Authenticator</a>
+    <li><a href="#ref-for-dfn-extension-commands⑤">11.5. Add Credential</a>
+    <li><a href="#ref-for-dfn-extension-commands⑥">11.6. Get Credentials</a>
+    <li><a href="#ref-for-dfn-extension-commands⑦">11.7. Remove Credential</a>
+    <li><a href="#ref-for-dfn-extension-commands⑧">11.8. Remove All Credentials</a>
+    <li><a href="#ref-for-dfn-extension-commands⑨">11.9. Set User Verified</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dfn-getting-properties">
@@ -9740,11 +9753,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-dfn-buffer-source-type①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="term-for-dfn-get-buffer-source-reference">
-   <a href="https://heycam.github.io/webidl#dfn-get-buffer-source-reference">https://heycam.github.io/webidl#dfn-get-buffer-source-reference</a><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="term-for-dfn-get-buffer-source-copy">
+   <a href="https://heycam.github.io/webidl#dfn-get-buffer-source-copy">https://heycam.github.io/webidl#dfn-get-buffer-source-copy</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dfn-get-buffer-source-reference">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dfn-get-buffer-source-reference①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dfn-get-buffer-source-copy">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dfn-get-buffer-source-copy①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dfn-interface-object">
@@ -9803,14 +9816,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-focus">5.6. Abort Operations with AbortSignal</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="term-for-host-same-site">
-   <a href="https://url.spec.whatwg.org/#host-same-site">https://url.spec.whatwg.org/#host-same-site</a><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-host-same-site">3. Dependencies</a>
-    <li><a href="#ref-for-host-same-site①">10.1.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-host-same-site②">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-   </ul>
-  </aside>
   <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span class="content">Terms defined by reference</span><a class="self-link" href="#index-defined-elsewhere"></a></h3>
   <ul class="index">
    <li>
@@ -9925,6 +9930,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-concept-settings-object-origin">origin <small>(for environment settings object)</small></span>
      <li><span class="dfn-paneled" id="term-for-concept-document-permissions-policy">permissions policy</span>
      <li><span class="dfn-paneled" id="term-for-relevant-settings-object">relevant settings object</span>
+     <li><span class="dfn-paneled" id="term-for-same-site">same site</span>
      <li><span class="dfn-paneled" id="term-for-secure-context">secure context</span>
      <li><span class="dfn-paneled" id="term-for-the-textarea-element">textarea</span>
      <li><span class="dfn-paneled" id="term-for-concept-origin-tuple">tuple origin</span>
@@ -10051,7 +10057,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
     <ul>
      <li><span class="dfn-paneled" id="term-for-dfn-endpoint-node">endpoint node</span>
      <li><span class="dfn-paneled" id="term-for-dfn-extension-capability">extension capability</span>
-     <li><span class="dfn-paneled" id="term-for-dfn-extension-command">extension command</span>
+     <li><span class="dfn-paneled" id="term-for-dfn-extension-commands">extension command</span>
      <li><span class="dfn-paneled" id="term-for-dfn-getting-properties">getting a property</span>
      <li><span class="dfn-paneled" id="term-for-dfn-invalid-argument">invalid argument</span>
      <li><span class="dfn-paneled" id="term-for-dfn-matching-capabilities">matching capabilities</span>
@@ -10085,7 +10091,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-unknownerror">UnknownError</span>
      <li><span class="dfn-paneled" id="term-for-idl-boolean">boolean</span>
      <li><span class="dfn-paneled" id="term-for-dfn-buffer-source-type">buffer source types</span>
-     <li><span class="dfn-paneled" id="term-for-dfn-get-buffer-source-reference">get a copy of the bytes held by the buffer source</span>
+     <li><span class="dfn-paneled" id="term-for-dfn-get-buffer-source-copy">get a copy of the bytes held by the buffer source</span>
      <li><span class="dfn-paneled" id="term-for-dfn-interface-object">interface object</span>
      <li><span class="dfn-paneled" id="term-for-dfn-json-types">json type</span>
      <li><span class="dfn-paneled" id="term-for-idl-long">long</span>
@@ -10098,11 +10104,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
     <ul>
      <li><span class="dfn-paneled" id="term-for-focus">focus</span>
     </ul>
-   <li>
-    <a data-link-type="biblio">[WHATWG URL]</a> defines the following terms:
-    <ul>
-     <li><span class="dfn-paneled" id="term-for-host-same-site">same site</span>
-    </ul>
   </ul>
   <h2 class="no-num no-ref heading settled" id="references"><span class="content">References</span><a class="self-link" href="#references"></a></h2>
   <h3 class="no-num no-ref heading settled" id="normative"><span class="content">Normative References</span><a class="self-link" href="#normative"></a></h3>