Add requestOrigin attribute to DigitalCredential - #567
Open
marcoscaceres wants to merge 14 commits into
Open
Conversation
Thread the `origin` parameter from Credential Management's `[[DiscoverFromExternalSource]]` through to the request context as `document origin`. This is the calling document's origin (i.e., the iframe's origin in cross-origin scenarios), which is needed for request validation. The top-level origin remains for credential chooser UI display. Both are now available in the request context for their respective purposes. Closes #504
The request context now carries both the document origin, the origin in which the request was made (the calling document's environment settings object's origin, per Credential Management), and the top-level origin, used only when presenting the request to the user. This lets the digital credential chooser attribute a cross-origin request to the site the user is visiting while leaving the document origin unchanged. Adds guidance on presenting one origin versus both, keyed on whether the two origins are same site, and an open issue on whether disclosing both origins should be a MUST rather than a SHOULD for cross-origin requests.
Drops the WebAuthn and Storage Access analogies from the credential chooser presentation note, and replaces the inline issue with a reference to the filed issue on whether the disclosure should be a MUST and whether to refuse the request when both origins cannot be conveyed.
Replaces the SHOULD-based prose with a switch, matching the style used for error handling, stating which origins the credential chooser presents: the top-level origin when it and the document origin are same site, and both origins otherwise. Removes the inline issue marker.
marcoscaceres
force-pushed
the
add-document-origin-to-request-context
branch
from
July 30, 2026 12:16
94a9737 to
0152cb1
Compare
Collaborator
Author
|
@copilot resolve the merge conflicts in this pull request |
…gin-attr Co-authored-by: marcoscaceres <870154+marcoscaceres@users.noreply.github.com>
Contributor
Done — resolved the merge conflicts with |
|
Discussed again on Series A call, 10 August 2026 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exposes the origin the response was bound to on the returned credential, so an encrypted response can be tied to the origin it was produced for, consistent with how
protocolanddatamake the response self-describing. Closes #566. Relates to #512, #520, #95.The following tasks have been completed:
requestOriginattribute is covered by WPT's auto-generated IDL (extracted from the published spec by Reffy into webref), which will pick it up automatically once this merges.Implementation commitment:
Documentation and checks:
Preview | Diff