Re: [webauthn] Related origin validation should reference the Fetch spec (#2408)

Is it possible to implement the .well-known fetch using the Fetch API? The spec says:
> When following redirects, [WebAuthn Clients](https://w3c.github.io/webauthn/#webauthn-client) MUST explicitly require all redirects to also use the https: [scheme](https://url.spec.whatwg.org/#concept-url-scheme).

I don't think the Fetch API exposes enough information about intermediate hops in a redirect chain to enforce this.

Maybe what we want is for the response URL to be same-origin with the request URL? We could enforce that with the Fetch API, but only if we remove the "all redirects use https:" requirement. The Fetch API would not give you enough information to exclude an http: scheme on the B hop of an A -> B -> A chain.

-- 
GitHub Notification of comment by jschanck
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2408#issuecomment-4306208358 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 23 April 2026 16:49:05 UTC