- From: Firstyear via GitHub <sysbot+gh@w3.org>
- Date: Wed, 18 May 2022 23:28:55 +0000
- To: public-webauthn@w3.org
> On 2022-05-18 WG call: we should also point out that RPs need to make sure their subdomains are sufficiently secured too. For example, if users can run arbitrary script on a subdomain of the RP ID, then user-submitted code could hijack authentications for the parent domain. The reading of the current was spec was that RP's are origins are strict equality, and don't allow subdomains. In webauthn-rs we default to strict equals, and only if you allow a security setting are subdomains allowed. So I think this could be a better way to structure the document for secure-by-defalut. -- GitHub Notification of comment by Firstyear Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1731#issuecomment-1130728947 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 18 May 2022 23:28:56 UTC