Re: Proposal: https://example.com/.well-known/modify-credentials

On Mon, Apr 9, 2018 at 9:21 AM, John Wilander <wilander@apple.com> wrote:

> Native apps and password managers can just load the URL in the browser or
> an in-app WebView instead of fetching the JSON, parse it, and then load the
> page.
>

Browsers or general purpose apps have to load it once (or a HEAD request at
least) to see if it exists before showing the user that it's an option​,
and then load it again when the user selects it. You can't present a Log-in
button that goes to a 404 page. A site-specific app could rely on that URL
existing, but then it could just as easily have some other site-specific
URL built-in.

But we don’t have strong opinions on this.
>

​I don't either. I'll ask our password manager folks to chime in.

-Dan Veditz