webauthn icon indicating copy to clipboard operation
webauthn copied to clipboard

CollectedClientData.crossOrigin default value and whether it is required

Open equalsJeffH opened this issue 3 years ago • 1 comments

CollectedClientData.crossOrigin is defined like so:

dictionary CollectedClientData {
    [ ... ]
    boolean                      crossOrigin;
    [ ... ]
};

In examining both the [[Create]]() and [[DiscoverFromExternalSource]]() methods, as well as the CollectedClientData serialization, it appears that crossOrigin is invariably added to collectedClientData, and that it's default value is (effectively) False.

Did we not stipulate it as required in the above WebIDL declaration for backwards compatiblity reasons?

In any case, I think it'd be good to add a note along these lines (to help obviate grovelling thru the spec to figure this out):

crossOrigin, of type boolean This member contains the inverse of the sameOriginWithAncestors argument value that was passed into the internal method. Note: This member is always added to CollectedClientData by the [[Create]]() and [[DiscoverFromExternalSource]]() methods. If for some reason it is not present in CollectedClientData, and the Section 5.8.1.1 Serialization is used, it defaults to False.

equalsJeffH avatar Jun 19 '21 00:06 equalsJeffH