Re: [webauthn] Please coordinate with the HTML spec to extract the relevant bits of the document.domain setter so you can call them

>> nominally steps 4 - 7 (inclusive) of the domain attribute setter 
defined hereabouts

> OK.  So if a page is loaded from "https://foo.bar.com" and then sets
 document.domain to "bar.com", should it be able to use "foo.bar.com" 
as its rpId?  Sounds to me like you're saying it shouldn't be able 
to....

Our present intent (if it is correct) is that even if 
"https://foo.bar.com" is loaded and then sets document.domain to 
"bar.com", it *would* still be able to assert "foo.bar.com" as its 
rpId.




-- 
GitHub Notification of comment by equalsJeffH
Please view or discuss this issue at 
https://github.com/w3c/webauthn/issues/256#issuecomment-268906588 
using your GitHub account