- From: Anders Åberg via GitHub <sysbot+gh@w3.org>
- Date: Mon, 29 Jan 2024 09:40:45 +0000
- To: public-webauthn@w3.org
abergs has just submitted a new pull request for https://github.com/w3c/webauthn: == Adding flexibility in client origin scheme validation to align with real world implementations == I suggest adding a little bit of flexibility to the requirements on validating the scheme to be `https`. This is in response to the real world implementation by clients, where clients (browsers, chrome) allow webauthn on `localhost` running on the `http`-scheme. We've been receiving negative feedback for following this part of the spec. I wanted to suggest adding just a little bit of flexibility here, hopefully without opening a can of DNS worms. I might be sticking my shin out here, since I know the topic of localhost has been brought up in previous calls with varying (dis)-agreement. E.g issue #1204 morphed into a discussion on DNS. Either I'm misinterpreting the current writing, but to me it's quite clear about not allowing `http` in any case.  See https://github.com/w3c/webauthn/pull/2018 -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Monday, 29 January 2024 09:40:47 UTC