Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

explicitly mention running over TLS in WebAuthn API intro #1201

Closed
equalsJeffH opened this issue Apr 18, 2019 · 1 comment · Fixed by #1327
Closed

explicitly mention running over TLS in WebAuthn API intro #1201

equalsJeffH opened this issue Apr 18, 2019 · 1 comment · Fixed by #1327
Assignees
@equalsJeffH
Labels
stat:pr-open type:editorial
Milestone
L2-WD-02

Comments

@equalsJeffH
Copy link
Contributor

the WebAuthn API intro has a parag saying:

The client facilitates these security measures by providing the Relying Party's origin and RP ID to the authenticator for each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in secure contexts.

We should explicitly note that being in a secure context means that network connections must all be over secure transport (e.g., TLS) established without errors.
@equalsJeffH equalsJeffH added this to the L2-WD-02 milestone Apr 18, 2019
@equalsJeffH equalsJeffH self-assigned this Apr 18, 2019
@gmandyam
Copy link

@equalsJeffH

Would have to see the text proposal, but bear in mind that secure context does not necessarily mean the webpage was retrieved via a TLS connection. For instance, https://www.w3.org/TR/secure-contexts/#localhost has a 127.0.0.1 carve-out that in my experience browser vendors have honored with respect to other API's requiring secure contexts (e.g. Encrypted Media Extensions).

Rather than try to paraphrase what a secure context actually means in the Webauthn intro, I would consider adding a reference to how the UA should determine if a webpage corresponds to a secure context: https://www.w3.org/TR/secure-contexts/#algorithms

@emlun emlun mentioned this issue Oct 18, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@equalsJeffH equalsJeffH

Labels
stat:pr-open type:editorial
Projects
None yet
Milestone
L2-WD-02
Development

Successfully merging a pull request may close this issue.

Explicitly mention running over TLS in WebAuthn API intro w3c/webauthn
3 participants
@equalsJeffH @emlun @gmandyam