Re: [webauthn] Missing validation of rpId before Related Origins fetch (#2422)

I agree some validation is missing here. It may be appropriate to reference the [opaque-host parser](https://url.spec.whatwg.org/#concept-opaque-host-parser) procedure from the URL spec to compute the value that gets inserted in the well-known URL template.

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2422#issuecomment-4458766649 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Friday, 15 May 2026 09:50:53 UTC