Re: [webauthn] document why only "valid domain" format is allowed for "effective domain"

This issue has two parts.  PR #515 addressed the first part by making explicit that "IP address identification of all forms is excluded." (thx).

However, the rationale is not stated, e.g.:
> This is for simplification and also is in recognition of various issues with using direct IP address identification in concert with PKI-based security.

..which we can simply add to the Notes pr #515 added.


-- 
GitHub Notification of comment by equalsJeffH
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/517#issuecomment-400882367 using your GitHub account

Received on Thursday, 28 June 2018 01:33:10 UTC