Bug 234309

Summary:

[WebAuthn] Allow same-site, cross-origin iframe get()

Product:

WebKit

Reporter:

pascoe <pascoe>

Component:

WebKit Misc.

Assignee:

pascoe <pascoe>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, cdumez, changseok, esprehn+autocc, ews-watchlist, gyuyoung.kim, jiewen_tan, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

234180

Attachments:

Description	Flags
Patch	none
Patch	none
Patch	none

pascoe@apple.com

Reported 2021-12-14 13:33:14 PST

WebAuthn Level 2 specifies a feature policy: https://w3c.github.io/webauthn/#sctn-iframe-guidance, functionality to get credentials from a cross-origin iframe should be enabled if the iframe has the allow="publickey-credentials-get" attribute/value pair. This patch implements this functionality only for same-site, cross-origin i-frames. This bug is to reland: https://bugs.webkit.org/show_bug.cgi?id=234180

Attachments
Patch (43.36 KB, patch) 2021-12-14 13:37 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (43.22 KB, patch) 2021-12-14 16:40 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (43.16 KB, patch) 2021-12-15 11:05 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.