Add note about actual implementations of appid. #1032
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This change adds a note to the `appid` extension remarking that, in practice, I don't think anyone actually implements the FIDO FacetID spec fully and instead checks whether the claimed AppID is same host with the origin. Fixes w3c#972.
selfissued
reviewed
Aug 10, 2018
| @@ -4257,6 +4264,11 @@ JavaScript APIs. | |||
| <var ignore>allowCredentialDescriptorList</var> and set |output| to [TRUE]. The value of |appId| then replaces the `rpId` | |||
| parameter of [=authenticatorGetAssertion=]. | |||
|
|
|||
| Note: In practice, several implementations do not implement steps four and onward of the | |||
| algorithm for [=determining if a caller's FacetID is authorized for an AppID=]. | |||
| Instead, in step three, the comparison on the host is relaxed to accept hosts on the | |||
There was a problem hiding this comment.
What does "hosts on the same site" mean? Do you mean subdomains, such as "onmicrosoft.com" also matching "mytenant.onmicrosoft.com"?
There was a problem hiding this comment.
The words same site should be linked in the generated HTML to the WHATWG specification which defines this.
selfissued
requested changes
Aug 10, 2018
selfissued
approved these changes
Aug 15, 2018
|
@aql Please merge |
WebAuthnBot
pushed a commit
that referenced
this pull request
Aug 22, 2018
WebAuthnBot
pushed a commit
that referenced
this pull request
Aug 22, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adds a note to the
appidextension remarking that, inpractice, I don't think anyone actually implements the FIDO FacetID spec
fully and instead checks whether the claimed AppID is same host with the
origin.
Fixes #972.
Preview | Diff