"authentication" attribute on Navigator should be [SecureContext]

[bzbarsky]

The WebAuthentication interface is, but the "authentication" attribute is not. That seems a bit odd. If this is purposeful, it's worth a note explaining why.

[equalsJeffH]

it is not purposeful -- is not clear (to me) from https://heycam.github.io/webidl and https://www.w3.org/TR/secure-contexts/ that we need to add the [SecureContext] extended attr to Navigator.authentication. we can certainly add it.

[bzbarsky]

It depends on your desired behavior. What should navigator.authentication return on a page loaded from "http://example.com"?

[selfissued]

Since this affects behavior of implementations, we should decide this and address it for the Implementer's Draft.

[equalsJeffH]

It would seem this issue will go away if PR #384 "integration of webauthn and credman" is merged?

[mikewest]

I also think this is obviated by #384, which moves things to navigator.credentials, which is already [SecureContext]: https://w3c.github.io/webappsec-credential-management/#framework-credential-management

[equalsJeffH]

fixed by PR #384, closing