Skip to content

Add document origin to request context #512

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
marcoscaceres wants to merge 18 commits into
base: main
Choose a base branch
from
Open

Add document origin to request context #512

Changes from 14 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
9be674d
Add document origin to request context
marcoscaceres May 9, 2026
cdce353
editorial: remove top-level origin from request context
marcoscaceres May 19, 2026
6f68882
Retain top-level origin for credential chooser presentation
marcoscaceres Jun 17, 2026
55f1bf7
Simplify presentation note; track open question as issue
marcoscaceres Jun 18, 2026
e1edca9
Present chooser origins via a declarative switch
marcoscaceres Jun 18, 2026
8c90a90
Reject requests from an opaque top-level origin
marcoscaceres Jul 14, 2026
b6bdfbf
Require the user agent to determine request origins
marcoscaceres Jul 15, 2026
b22a845
Apply suggestion from @TallTed
marcoscaceres Jul 30, 2026
8313722
Apply suggestion from @TallTed
marcoscaceres Jul 30, 2026
170d229
Simplify how the top-level origin is derived
marcoscaceres Jul 30, 2026
a09cdff
Remove RFC2119 keywords from the informative security section
marcoscaceres Jul 30, 2026
0152cb1
Use the settings object origin, which HTML defines for security checks
marcoscaceres Jul 30, 2026
504c863
Require the user agent to determine the request origins
marcoscaceres Jul 31, 2026
de8c118
Apply suggestions from code review
marcoscaceres Aug 6, 2026
3360ce3
chore: normalize index.html line endings to LF
marcoscaceres Aug 12, 2026
7576dcf
Merge main and resolve conflicts
Copilot Aug 20, 2026
1d66a0a
Merge branch 'main' into add-document-origin-to-request-context
marcoscaceres Aug 20, 2026
2b71d78
editorial: restore prepare credential requests dfn
Copilot Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
139 changes: 122 additions & 17 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -790,6 +790,13 @@ <h2>
interaction outcome.
</li>
</ul>
<p>
A [=user agent=] MUST use its own determination of the [=request
context/document origin=] and the [=request context/top-level origin=],
and MUST NOT rely on an [=origin=] supplied by the content whose request
is being mediated, in determining whether to validate or form the request
Comment thread
marcoscaceres marked this conversation as resolved.
Outdated
or to present the [=digital credential chooser=].
</p>
<p>
A user agent MAY delegate some or all coordinator responsibilities to
external [=credential managers=], platform components, or other trusted
Expand Down Expand Up @@ -847,10 +854,11 @@ <h3>
</h3>
<p>
To <dfn data-dfn-for="credential request coordinator">prepare credential
requests</dfn> given a [=Document=] |document:Document|, a [=sequence=]
of {{DigitalCredentialGetRequest}} values or a [=sequence=] of
{{DigitalCredentialCreateRequest}} values |requests|, a {{Promise}}
|promise:Promise|, and an optional {{AbortSignal}} |signal:AbortSignal|:
requests</dfn> given an [=origin=] |documentOrigin|, a [=Document=]
|document:Document|, a [=sequence=] of {{DigitalCredentialGetRequest}}
values or a [=sequence=] of {{DigitalCredentialCreateRequest}} values
|requests|, a {{Promise}} |promise:Promise|, and an optional
{{AbortSignal}} |signal:AbortSignal|:
</p>
<ol class="algorithm">
<li>Let |global| be |document|'s [=relevant global object=].
Expand Down Expand Up @@ -937,7 +945,8 @@ <h3>
<li>If |handled| is `true`, return.
</li>
<li>[=credential request coordinator/Initiate the credential request=]
with |document|, |validatedRequests|, |promise|, and |signal|.
with |documentOrigin|, |document|, |validatedRequests|, |promise|, and
|signal|.
</li>
</ol><!--
// MARK: Validate credential requests
Expand Down Expand Up @@ -1101,18 +1110,22 @@ <h3>
</h3>
<p>
To <dfn data-dfn-for="credential request coordinator">initiate the
credential request</dfn> given a [=Document=] |document|, a [=list=] of
validated credential requests |validatedRequests|, a {{Promise}}
|promise:Promise|, and an optional {{AbortSignal}} |signal|:
credential request</dfn> given an [=origin=] |documentOrigin|, a
[=Document=] |document|, a [=list=] of validated credential requests
|validatedRequests|, a {{Promise}} |promise:Promise|, and an optional
{{AbortSignal}} |signal|:
</p>
<ol class="algorithm">
<li>Let |topLevelOrigin| be |document|'s [=top-level traversable=]'s
[=navigable/active document=]'s [=relevant settings object=]'s
[=environment settings object/origin=].
<li>Let |topLevelDocument| be the [=navigable/active document=] of the
[=navigable/top-level traversable=] of |document|'s [=node navigable=].
</li>
<li>Let |topLevelOrigin| be |topLevelDocument|'s [=relevant settings
object's=] [=environment settings object/origin=].
</li>
<li>Let |requestData| be a new [=request context=] whose [=request
context/requests=] is |validatedRequests| and [=request context/top-level
origin=] is |topLevelOrigin|.
context/requests=] is |validatedRequests|, [=request context/document
origin=] is |documentOrigin|, and [=request context/top-level origin=] is
|topLevelOrigin|.
</li>
<li>[=In parallel=]:
<ol>
Expand All @@ -1132,6 +1145,41 @@ <h3>
located on a different device, it is RECOMMENDED that the [=user
agent=] use [[[FIDO-CLIENT-TO-AUTHENTICATOR-PROTOCOL-V2.3]]].
</p>
<p>
The origins presented to the user are determined as follows:
</p>
<dl class="switch">
<dt>
|requestData|'s [=request context/document origin=] and its
[=request context/top-level origin=] are [=same site=]:
Comment thread
marcoscaceres marked this conversation as resolved.
</dt>
<dd>
The [=request context/top-level origin=] is presented to the
user.
</dd>
<dt>
Otherwise:
</dt>
<dd>
Both the [=request context/top-level origin=] and the [=request
context/document origin=] are presented to the user, conveying
that the [=request context/document origin=] is embedded within
the page at the [=request context/top-level origin=] and would
receive the requested [=digital credential=].
</dd>
</dl>
<p class="note">
Presenting only the [=request context/document origin=] can
prevent the user from associating the request with the site they
are visiting, as that origin is typically not reflected in the
[=user agent=]'s address bar. Presenting only the [=request
context/top-level origin=] can mislead the user about which party
would receive the [=digital credential=]. Where the [=digital
credential chooser=] is provided by the underlying platform, the
[=user agent=] makes both origins available to it so that they
can be presented to the user.
</p>
<aside class="issue" data-number="456"></aside>
</li>
<li>If |signal| is not null and |signal| is [=AbortSignal/aborted=]:
<ol>
Expand Down Expand Up @@ -1593,12 +1641,27 @@ <h4>
<dd>
A [=list=] of validated [=digital credential/credential requests=].
</dd>
<dt>
<dfn data-dfn-for="request context">document origin</dfn>
</dt>
<dd>
An [=origin=]; the [=origin=] in which the request was made, that is,
the [=current settings object=]'s [=environment settings
object/origin=] as provided to the internal methods in
[[[#credential-management-integration]]]. When the request is made from
a [=Document=] embedded in a cross-origin context, this is the embedded
[=Document=]'s [=origin=] and not the [=request context/top-level
origin=].
</dd>
<dt>
<dfn data-dfn-for="request context">top-level origin</dfn>
</dt>
<dd>
An [=environment settings object=]'s [=environment settings
object/origin=].
An [=origin=]; the [=origin=] of the [=navigable/top-level
traversable=] in which the request was made, as determined by
[=credential request coordinator/initiate the credential request=]. It
is used only when presenting the request to the user; it is not used to
validate or form the request.
</dd>
</dl>
<h4>
Expand Down Expand Up @@ -1663,6 +1726,15 @@ <h3>
top-level traversable with user attention=], return [=a promise rejected
with=] a {{"NotAllowedError"}} {{DOMException}}.
</li>
<li>Let |topLevelDocument| be the [=navigable/active document=] of the
[=navigable/top-level traversable=] of |document|'s [=node navigable=].
</li>
<li>Let |topLevelOrigin| be |topLevelDocument|'s [=relevant settings
object's=] [=environment settings object/origin=].
</li>
<li>If |topLevelOrigin| is an [=opaque origin=], return [=a promise
rejected with=] a {{"SecurityError"}} {{DOMException}}.
</li>
<li>Let |requests| be |options|'s {{CredentialRequestOptions/digital}}'s
{{DigitalCredentialRequestOptions/requests}} member.
</li>
Expand All @@ -1674,7 +1746,8 @@ <h3>
<li>Let |promise| be [=a new promise=] in [=this=]'s [=relevant realm=].
</li>
<li>[=credential request coordinator/Prepare credential requests=] with
|document|, |requests|, |promise|, and |signal|.
|origin| as |documentOrigin|, |document|, |requests|, |promise|, and
|signal|.
</li>
<li>Return |promise|.
</li>
Expand Down Expand Up @@ -1723,6 +1796,15 @@ <h3>
top-level traversable with user attention=], return [=a promise rejected
with=] a {{"NotAllowedError"}} {{DOMException}}.
</li>
<li>Let |topLevelDocument| be the [=navigable/active document=] of the
[=navigable/top-level traversable=] of |document|'s [=node navigable=].
</li>
<li>Let |topLevelOrigin| be |topLevelDocument|'s [=relevant settings
object's=] [=environment settings object/origin=].
</li>
<li>If |topLevelOrigin| is an [=opaque origin=], return [=a promise
rejected with=] a {{"SecurityError"}} {{DOMException}}.
</li>
<li>Let |requests| be |options|'s {{CredentialCreationOptions/digital}}'s
{{DigitalCredentialCreationOptions/requests}} member.
</li>
Expand All @@ -1735,7 +1817,8 @@ <h3>
realm=] of [=this=].
</li>
<li>[=credential request coordinator/Prepare credential requests=] with
|document|, |requests|, |promise|, and |signal|.
|origin| as |documentOrigin|, |document|, |requests|, |promise|, and
|signal|.
</li>
<li>Return |promise|.
</li>
Expand Down Expand Up @@ -1933,6 +2016,28 @@ <h3>
operation.
</li>
</ul>
<p>
The [=request context/document origin=] and [=request context/top-level
origin=] are determined by the [=user agent=]: the [=request
context/document origin=] is the [=origin=] passed to
{{DigitalCredential/[[DiscoverFromExternalSource]](origin, options,
sameOriginWithAncestors)}} and {{DigitalCredential/[[Create]](origin,
options, sameOriginWithAncestors)}} by the
[[[#credential-management-integration]]]; the [=request
context/top-level origin=] is that of the [=navigable/active document=]
of the [=navigable/top-level traversable=] in which the request was
made. [[[#credential-request-coordinator]]] requires the [=user agent=]
to use its own determination of both, and to not rely on an [=origin=]
supplied by the content whose request is being mediated, in determining
whether to validate or form the request or to present the [=digital
Comment thread
marcoscaceres marked this conversation as resolved.
Outdated
credential chooser=].
</p>
<p>
This mitigates [=Unauthorized Cross-Origin Access=]: the party that is
shown to the user, and that would receive the [=digital credential=],
reflects the [=user agent=]'s own determination of who is asking,
rather than a value the requesting content can choose.
</p>
<p>
For additional guidance on preventing abuse of credential requests,
please refer to the section
Expand Down
Loading