-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add required mediation #149
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that "optional"
would also be acceptable here. That would be the page telling the browser that it may show UI, which is all that is being validated, correct?
@bvandersloot-mozilla, right. I guess it depends on how you read the definition of "optional" from Cred Man:
My reading from the above, and what I'm worried about, is that leaving it as "optional" invites optionality in presenting UI (which presuppose is always "required"). For completeness, here is how required is defined:
|
So, I guess we could do things differently... we could state in the spec that "mediation is always required" for this kind of credential, but we need to fix w3c/webappsec-credential-management#248 (issue: user mediation is currently origin bound instead of type bound)... that could allow "optional", but enforce showing UI in prose and in Cred Man (possibly as part of the registry). |
Yeah, that will work I think. It is just a little confusing because the mediation parameter prescribes the set of allowable behaviors for the manager and the credential types to take, rather than describing what will happen depending on state. |
@samuelgoto, wouldn't mind your thoughts on this. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh I like this. Our privacy stance requires user mediation for every presentment, so this seems like a good way to reinforce that.
Ok, so, yeah... per step 8.1 of of Cred Man:
So, we actually just need to state that mediation is required but not as part of the algorithm... will fix. |
@TallTed 🦅 👀 🙏? ... 😊 |
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by NOBODY (OOPS!). Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: Added. * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get):
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Small, human-facing.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM++
I think that "optional" would also be acceptable here. That would be the page telling the browser that it may show UI, which is all that is being validated, correct?
I share the intuition that we may want to support optional
too at some point, but I think we can cross the bridge of optional
when we get there without cornering ourselves.
For "required" and "optional"... I think I have a better solution for all this: We need fix the Cred Man API to allow us to set our own default. |
@samuelgoto, @bvandersloot-mozilla, here's a first stab at fixing this in Cred Man: |
Co-authored-by: Ted Thibodeau Jr <[email protected]>
For those watching at home, this would mean that the following would not throw: navigator.identity.get({digital: ...}); // this throws today, which is annoying.
navigator.identity.get({digital: ..., mediation: "required"}); This will continue to throw: navigator.identity.get({digital: ..., mediation: "conditional"});
navigator.identity.get({digital: ..., mediation: "silent"}); |
(also, |
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by NOBODY (OOPS!). Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/http/wpt/identity/identitycredentialscontainer-get-hidden.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/allow-attribute.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/dc-types.ts: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/support/helper.js: (export.makeGetOptions): * LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get):
I'm not sure I follow this reference, but I was actually discussion https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-optional |
Sorry @samuelgoto, I might have confused myself 🙈 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM++
Just a few minor clarifications.
(added chromium bug for implementation) |
Co-authored-by: Sam Goto <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by NOBODY (OOPS!). Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/http/wpt/identity/identitycredentialscontainer-get-hidden.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/allow-attribute.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/dc-types.ts: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/support/helper.js: (export.makeGetOptions): * LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get):
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by NOBODY (OOPS!). Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/http/wpt/identity/identitycredentialscontainer-get-hidden.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/allow-attribute.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/dc-types.ts: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/support/helper.js: (export.makeGetOptions): * LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: * LayoutTests/platform/ios/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get):
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by NOBODY (OOPS!). Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/http/wpt/identity/identitycredentialscontainer-get-hidden.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/allow-attribute.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/dc-types.ts: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/support/helper.js: (export.makeGetOptions): * LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: * LayoutTests/platform/ios/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get):
https://bugs.webkit.org/show_bug.cgi?id=277322 rdar://133266859 Reviewed by Anne van Kesteren. Make sure mediation is alway required when getting digital credentials as required by the spec: WICG/digital-credentials#149 * LayoutTests/http/wpt/identity/identitycredentialscontainer-get-hidden.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/allow-attribute.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/dc-types.ts: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https.html: * LayoutTests/imported/w3c/web-platform-tests/digital-credentials/support/helper.js: (export.makeGetOptions): * LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: * LayoutTests/platform/ios/imported/w3c/web-platform-tests/digital-credentials/identity-get.tentative.https-expected.txt: * Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp: (WebCore::IdentityCredentialsContainer::get): Canonical link: https://commits.webkit.org/283148@main
As we were implementing this PR here, something occurred to me while reviewing it: (a) first, this is a backwards incompatible change for us: If this is correct, then can we make this more flexible and also allow the default value of |
FWIW, we found a resolution to this here: |
Closes #147
The following tasks have been completed:
Implementation commitment:
Documentation and checks
Preview | Diff