Add document origin to request context by marcoscaceres · Pull Request #512 · w3c-fedid/digital-credentials

marcoscaceres · 2026-05-09T05:09:46Z

Fixes a spec bug where Digital Credentials requests from cross-origin iframes use the wrong origin. Credential Management already passes the calling document's origin to [[DiscoverFromExternalSource]], but the spec was re-deriving the top-level origin instead. This threads documentOrigin through prepare credential requests and initiate the credential request, storing it in the request context struct as document origin (replacing top-level origin).

Closes #333
Closes #504

Modified Web platform tests (link)

Implementation commitment:

WebKit
Chromium (link to issue)
Gecko (link to issue)

Documentation and checks:

Preview | Diff

Copilot

Pull request overview

This PR updates the Digital Credentials specification to correctly thread the calling document’s origin through the request pipeline, so cross-origin iframe requests no longer (incorrectly) use only the top-level origin when constructing request context and presenting UI.

Changes:

Add a documentOrigin parameter to “prepare credential requests” and “initiate the credential request”, and store it as document origin in the request context struct.
Retain top-level origin in request context, clarifying it is for user presentation only, and add guidance on presenting one vs. two origins.
Add a SecurityError rejection when the top-level origin is opaque in [[DiscoverFromExternalSource]] and [[Create]].

hlflanagan · 2026-07-27T16:48:52Z

Discussed on 27 July 2026. Group requested to review.

Thread the `origin` parameter from Credential Management's `[[DiscoverFromExternalSource]]` through to the request context as `document origin`. This is the calling document's origin (i.e., the iframe's origin in cross-origin scenarios), which is needed for request validation. The top-level origin remains for credential chooser UI display. Both are now available in the request context for their respective purposes. Closes #504

The request context now carries both the document origin, the origin in which the request was made (the calling document's environment settings object's origin, per Credential Management), and the top-level origin, used only when presenting the request to the user. This lets the digital credential chooser attribute a cross-origin request to the site the user is visiting while leaving the document origin unchanged. Adds guidance on presenting one origin versus both, keyed on whether the two origins are same site, and an open issue on whether disclosing both origins should be a MUST rather than a SHOULD for cross-origin requests.

Drops the WebAuthn and Storage Access analogies from the credential chooser presentation note, and replaces the inline issue with a reference to the filed issue on whether the disclosure should be a MUST and whether to refuse the request when both origins cannot be conveyed.

Replaces the SHOULD-based prose with a switch, matching the style used for error handling, stating which origins the credential chooser presents: the top-level origin when it and the document origin are same site, and both origins otherwise. Removes the inline issue marker.

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

TallTed · 2026-08-07T16:54:38Z

      and MUST NOT rely on an [=origin=] supplied by the content whose request
-      is being mediated, whether to validate or form the request or to present
-      the [=digital credential chooser=].
+      is being mediated, in determining whether to validate or form the request


Suggested change

is being mediated, in determining whether to validate or form the request

is being mediated, in determining whether to validate or form a request

TallTed · 2026-08-07T16:55:10Z

-        validate or form the request or to present the [=digital credential
-        chooser=].
+        supplied by the content whose request is being mediated, in determining
+        whether to validate or form the request or to present the [=digital


Suggested change

whether to validate or form the request or to present the [=digital

whether to validate or form a request or to present the [=digital

hlflanagan · 2026-08-10T17:34:24Z

Discussed on 10 August 2026 call. @timcappalli to review.

marcoscaceres requested a review from a team as a code owner May 9, 2026 05:09

marcoscaceres force-pushed the add-document-origin-to-request-context branch from 35d6fd7 to 97c81cf Compare June 17, 2026 09:16

This was referenced Jun 17, 2026

Top frame origin should be passed to client platforms and credential managers for cross-origin requests #333

Open

Should presenting both origins for cross-origin requests be a MUST? #545

Closed

marcoscaceres added the agenda+ Add to the weekly agenda label Jul 9, 2026

marcoscaceres force-pushed the add-document-origin-to-request-context branch from 8943e25 to 2f17374 Compare July 14, 2026 08:21

marcoscaceres requested a review from Copilot July 14, 2026 08:31

Copilot started reviewing on behalf of marcoscaceres July 14, 2026 08:31 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread index.html

Comment thread index.html Outdated

Comment thread index.html Outdated

marcoscaceres force-pushed the add-document-origin-to-request-context branch from 2f17374 to 557bda9 Compare July 14, 2026 09:06

TallTed reviewed Jul 16, 2026

View reviewed changes

Comment thread index.html Outdated

TallTed reviewed Jul 16, 2026

View reviewed changes

Comment thread index.html Outdated

TallTed reviewed Jul 16, 2026

View reviewed changes

Comment thread index.html Outdated

This was referenced Jul 28, 2026

API does not expose the origin context used for response encryption #566

Open

Add requestOrigin attribute to DigitalCredential #567

Open

marcoscaceres and others added 12 commits July 30, 2026 18:08

editorial: remove top-level origin from request context

cdce353

Reject requests from an opaque top-level origin

8c90a90

Require the user agent to determine request origins

b6bdfbf

Apply suggestion from @TallTed

b22a845

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

Apply suggestion from @TallTed

8313722

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

Simplify how the top-level origin is derived

170d229

Remove RFC2119 keywords from the informative security section

a09cdff

Use the settings object origin, which HTML defines for security checks

0152cb1

marcoscaceres force-pushed the add-document-origin-to-request-context branch from 94a9737 to 0152cb1 Compare July 30, 2026 12:16

Require the user agent to determine the request origins

504c863

TallTed reviewed Jul 31, 2026

View reviewed changes

Comment thread index.html Outdated

TallTed reviewed Jul 31, 2026

View reviewed changes

Comment thread index.html Outdated

Apply suggestions from code review

de8c118

Co-authored-by: Ted Thibodeau Jr <tthibodeau@openlinksw.com>

TallTed reviewed Aug 7, 2026

View reviewed changes

timcappalli approved these changes Aug 11, 2026

View reviewed changes

chore: normalize index.html line endings to LF

3360ce3

marcoscaceres mentioned this pull request Aug 12, 2026

chore: add CI check for committed CRLF line endings #572

Merged

Navigation Menu

Uh oh!

Add document origin to request context - #512

Add document origin to request context#512
marcoscaceres wants to merge 15 commits into
mainfrom
add-document-origin-to-request-context

marcoscaceres commented May 9, 2026 •

edited by pr-preview Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hlflanagan commented Jul 27, 2026

Uh oh!

Uh oh!

Uh oh!

TallTed Aug 7, 2026 •

edited

Loading

Uh oh!

TallTed Aug 7, 2026

Uh oh!

hlflanagan commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	is being mediated, in determining whether to validate or form the request
	is being mediated, in determining whether to validate or form a request

	whether to validate or form the request or to present the [=digital
	whether to validate or form a request or to present the [=digital

Uh oh!

Conversation

marcoscaceres commented May 9, 2026 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hlflanagan commented Jul 27, 2026

Uh oh!

Uh oh!

Uh oh!

TallTed Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TallTed Aug 7, 2026

Choose a reason for hiding this comment

Uh oh!

hlflanagan commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

marcoscaceres commented May 9, 2026 •

edited by pr-preview Bot

Loading

TallTed Aug 7, 2026 •

edited

Loading