update extensions framework to include interfacing with user agent permissions framework

[equalsJeffH]

update extensions framework to include interfacing with user agent permissions framework

[equalsJeffH]

see also #208

[selfissued]

@equalsJeffH is there anything left to do for this issue? If so, are the concrete proposed changes? If not, we should close this one.

[nadalin]

@equalsJeffH , @selfissued Can we close this one since Mike has redone the extension section ?

[equalsJeffH]

@AngeloKai has asserted that interfacing with the permissions framework is not applicable for webauthn in this context, and AFAIK we've just accepted that, so closing this. tho, if someone disagrees please cite appropriate specs etc.

[riking]

I feel like this should be addressed - it seems like a mistake to allow websites to get geolocation information without the user being notified.

Here's a quick and dirty draft:

Client extension processing

Check the [[permissions state]] for geolocation. If the permission state is "denied", the client MUST remove the extension and not pass it to the authenticator. If the permission state is "prompt", the user agent MAY prompt the user and restart this processing, MAY remove the extension without prompting, or MAY treat it as a "granted" state. If the permission state is "granted", the client creates the authenticator extension input with the Boolean value true.

[equalsJeffH]

reopening due to #133 (comment)

[equalsJeffH]

It seems that having the geoloc extension check the permissions framework is a resonable thing since geoloc is a defined permision in: https://w3c.github.io/permissions/#permission-registry

[gmandyam]

@equalsJeffH

Wouldn't the client (UA) check the permissions framework, rather than the extension implementation itself? Since the client can choose to drop extensions, it can use the permissions framework as part of the criteria in determining whether to drop or not.

[equalsJeffH]

@gmandyam
Yeah, that might be the case, perhaps the extension only needs to say that the client platform ought to check permissions as appropriate and if available, e.g., geoloc, and reference https://w3c.github.io/permissions/ ?

[selfissued]

I agree that the client platform should do this check - not the extension

[nadalin]

@gmandyam will create PR

[selfissued]

@gmandyam can you please create the PR today or tomorrow morning so we can review it during the FIDO 2.0 meeting tomorrow? Thanks.

[gmandyam]

Addressed through #771

[selfissued]

Can this be closed now that #771 has been merged?