Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add topOrigin to the limited verification algorithm. #2104

Merged
merged 4 commits into from
Sep 12, 2024
Merged

Add topOrigin to the limited verification algorithm. #2104

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8d32e89
Update index.bs
zacknewman Jul 22, 2024
9bb78e4
Specify topOrigin is optional in the defintions.
zacknewman Aug 7, 2024
213cb24
Make topOrigin verification backwards compatible with L2
emlun Aug 14, 2024
60fc0e8
Infer crossOrigin argument from topOrigin
emlun Aug 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3832,6 +3832,7 @@ Verifiers may use the following algorithm to verify an encoded {{CollectedClient
1. A byte string, |challenge|, that contains the challenge byte string that was given in the {{PublicKeyCredentialRequestOptions}} or {{PublicKeyCredentialCreationOptions}}.
1. A string, |origin|, that contains the expected {{CollectedClientData/origin}} that issued the request to the user agent.
1. A boolean, |crossOrigin|, that is true if, and only if, the request should have been performed within a cross-origin <{iframe}>.
1. A string, |topOrigin|, that contains the expected {{CollectedClientData/topOrigin}} that issued the request to the user agent if |crossOrigin| is true and if available.
zacknewman marked this conversation as resolved.
Show resolved Hide resolved
1. Let |expected| be an empty byte string.
1. Append 0x7b2274797065223a (`{"type":`) to |expected|.
1. Append [=CCDToString=](|type|) to |expected|.
Expand All @@ -3843,6 +3844,9 @@ Verifiers may use the following algorithm to verify an encoded {{CollectedClient
1. Append 0x2c2263726f73734f726967696e223a (`,"crossOrigin":`) to |expected|.
1. If |crossOrigin| is true:
1. Append 0x74727565 (`true`) to |expected|.
1. If |topOrigin| is defined:
1. Append 0x2c22746f704f726967696e223a (`,"topOrigin":`) to |expected|.
1. Append [=CCDToString=](|topOrigin|) to |expected|.
emlun marked this conversation as resolved.
Show resolved Hide resolved
1. Otherwise, i.e. |crossOrigin| is false:
1. Append 0x66616c7365 (`false`) to |expected|.
1. If |expected| is not a prefix of |clientDataJSON| then the verification has failed.
Expand Down