webauthn
webauthn copied to clipboard
CollectedClientData.crossOrigin default value and whether it is required
CollectedClientData.crossOrigin is defined like so:
dictionary CollectedClientData {
[ ... ]
boolean crossOrigin;
[ ... ]
};
In examining both the [[Create]]() and [[DiscoverFromExternalSource]]() methods, as well as the CollectedClientData serialization, it appears that crossOrigin is invariably added to collectedClientData, and that it's default value is (effectively) False.
Did we not stipulate it as required in the above WebIDL declaration for backwards compatiblity reasons?
In any case, I think it'd be good to add a note along these lines (to help obviate grovelling thru the spec to figure this out):
crossOrigin, of type boolean This member contains the inverse of the sameOriginWithAncestors argument value that was passed into the internal method. Note: This member is always added to
CollectedClientDataby the[[Create]]()and[[DiscoverFromExternalSource]]()methods. If for some reason it is not present inCollectedClientData, and the Section 5.8.1.1 Serialization is used, it defaults to False.