Re: [webauthn] JSON-serialized client data is wrong

>There's still an issue with the current text in that if someone overwrites JSON it's still ambiguous.

This is not ambiguous, because the spec reads "the result of calling **the initial value** of `JSON.stringify`" (emphasis added). Even without the emphasized part, I'd argue that this is a reference specifically to the `JSON.stringify` function in the ECMAScript language spec, and not an instruction to "evaluate the expression `JSON.stringify` in the current JavaScript scope".

>Another problem I just realized is that you cannot invoke a JavaScript function on an IDL value. You first need to convert the IDL value to a JavaScript value.

This may be technically correct, but I cannot currently see how this would ever lead to any kind of confusion.

Furthermore, on both points: These steps are to be implemented internally in the client, not by third party JS code. I don't think the exact implementation details matter so much as the end result, and we have so far observed zero interoperability issues with this.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/712#issuecomment-366195021 using your GitHub account

Received on Friday, 16 February 2018 10:13:01 UTC