Skip to content

Deprecate in-field language/direction metadata #2308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 13, 2025
Merged

Deprecate in-field language/direction metadata #2308

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 13 additions & 20 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3253,7 +3253,7 @@ PublicKeyCredential.signalCurrentUserDetails({
rpId: "example.com",
userId: "aabbcc", // user handle, base64url.
name: "New user name",
displayName: "New display name"
displayName: "New display name",
});
```

Expand Down Expand Up @@ -3573,10 +3573,6 @@ associated with or [=scoped=] to, respectively.
[[!RFC8266]] for the Nickname Profile of the PRECIS FreeformClass [[!RFC8264]],
when setting {{PublicKeyCredentialEntity/name}}'s value, or displaying the value to the user.

- This string MAY contain language and direction metadata.
[=[RPS]=] SHOULD consider providing this information if setting the member to a value other than the [=RP ID=].
See [[#sctn-strings-langdir]] about how this metadata is encoded.

- [=Clients=] SHOULD perform enforcement, as prescribed in Section 2.3 of
[[!RFC8266]] for the Nickname Profile of the PRECIS FreeformClass [[!RFC8264]],
on {{PublicKeyCredentialEntity/name}}'s value prior to displaying the value to the user or
Expand All @@ -3596,8 +3592,6 @@ associated with or [=scoped=] to, respectively.
IdentifierClass [[!RFC8264]], when setting {{PublicKeyCredentialEntity/name}}'s value, or displaying the value
to the user.

- This string MAY contain language and direction metadata. [=[RPS]=] SHOULD consider providing this information. See [[#sctn-strings-langdir]] about how this metadata is encoded.

- [=Clients=] SHOULD perform enforcement, as prescribed in Section 3.4.3 of [[!RFC8265]]
for the UsernameCasePreserved Profile of the PRECIS IdentifierClass [[!RFC8264]],
on {{PublicKeyCredentialEntity/name}}'s value prior to displaying the value to the user or
Expand Down Expand Up @@ -3671,8 +3665,6 @@ credential.
when setting {{PublicKeyCredentialUserEntity/displayName}}'s value to a non-empty string,
or displaying a non-empty value to the user.

- This string MAY contain language and direction metadata. [=[RPS]=] SHOULD consider providing this information. See [[#sctn-strings-langdir]] about how this metadata is encoded.

- [=Clients=] SHOULD perform enforcement, as prescribed in Section 2.3 of
[[!RFC8266]] for the Nickname Profile of the PRECIS FreeformClass [[!RFC8264]],
on {{PublicKeyCredentialUserEntity/displayName}}'s value prior to displaying a non-empty value to the user or
Expand Down Expand Up @@ -5516,20 +5508,16 @@ but MUST NOT be shorter than the longest prefix substring that satisfies the siz

### Language and Direction Encoding ### {#sctn-strings-langdir}

In order to be correctly displayed in context, the language and base direction of a string [may be required](https://www.w3.org/TR/string-meta/#why-is-this-important). Strings in this API may have to be written to fixed-function [=authenticators=] and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.

To encode language and direction metadata in a string that is documented as permitting it, suffix its code points with two sequences of code points:

The first encodes a [=language tag=] with the code point U+E0001 followed by the ASCII values of the [=language tag=] each shifted up by U+E0000. For example, the [=language tag=] “en-US” becomes the code points U+E0001, U+E0065, U+E006E, U+E002D, U+E0055, U+E0053.

The second consists of a single code point which is either U+200E (“LEFT-TO-RIGHT MARK”), U+200F (“RIGHT-TO-LEFT MARK”), or U+E007F (“CANCEL TAG”). The first two can be used to indicate directionality but SHOULD only be used when neccessary to produce the correct result. (E.g. an RTL string that starts with LTR-strong characters.) The value U+E007F is a direction-agnostic indication of the end of the [=language tag=].
In order to be correctly displayed in context, the language and base direction of a string [may be required](https://www.w3.org/TR/string-meta/#why-is-this-important). Strings in this API may have to be written to fixed-function [=authenticators=] and then later read back and displayed on a different platform.

So the string “حبیب الرحمان” could have two different DOMString values, depending on whether the language was encoded or not. (Since the direction is unambiguous a directionality marker is not needed in this example.)
For compatibility with existing fixed-function [=authenticators=] without support for dedicated language and direction metadata fields,
Web Authentication Level 2 included provisions for embedding such metadata in the string itself to ensure that it is transported atomically.
This encoding is NOT RECOMMENDED; [=clients=] and [=authenticators=] MAY ignore such encoding in new values.
[=Clients=] and [=authenticators=] MAY detect and process language and direction metadata encoded in existing strings
as described in [[webauthn-2-20210408#sctn-strings-langdir|Web Authentication Level 2 §6.4.2. Language and Direction Encoding]].

* Unadorned string: U+062D, U+0628, U+06CC, U+0628, U+0020, U+0627, U+0644, U+0631, U+062D, U+0645, U+0627, U+0646
* With language “ar-SA” encoded: U+062D, U+0628, U+06CC, U+0628, U+0020, U+0627, U+0644, U+0631, U+062D, U+0645, U+0627, U+0646, U+E0001, U+E0061, U+E0072, U+E002D, U+E0053, U+E0041, U+E007F
Instead, a future version of the [=Web Authentication API=] may provide dedicated language and direction metadata fields.

Consumers of strings that may have language and direction encoded should be aware that truncation could truncate a [=language tag=] into a different, but still valid, language. The final directionality marker or CANCEL TAG code point provide an unambigous indication of truncation.

## Attestation ## {#sctn-attestation}

Expand Down Expand Up @@ -10069,6 +10057,11 @@ Deprecations:
[[#dictionary-pkcredentialentity]]
- [[#sctn-android-safetynet-attestation]]
- [=CollectedClientData/tokenBinding=] was changed to \[RESERVED].
- In-field language and direction metadata are no longer recommended:
- [[#sctn-strings-langdir]]
- <code>{{CredentialCreationOptions/publicKey}}.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialEntity/name}}</code>
- <code>{{CredentialCreationOptions/publicKey}}.{{PublicKeyCredentialCreationOptions/user}}.{{PublicKeyCredentialEntity/name}}</code>
- <code>{{CredentialCreationOptions/publicKey}}.{{PublicKeyCredentialCreationOptions/user}}.{{PublicKeyCredentialUserEntity/displayName}}</code>


New features:
Expand Down