linux-credentials / linux-credentials/credentialsd
Show both origin and RP ID in cross-origin contexts.
- Dominant language
- Rust
- Stars
- 259
- Forks
- 19
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 12
Description
In cross-origin contexts, it is important to show the user both the RP and the origin they are visiting.
We should follow the [WebAuthn advice about cross-origin UI](https://www.w3.org/TR/webauthn-3/#sctn-cross-origin-use), namely:
- calculate the registrable domain of the origin's hostname using Public Suffix List.
- For WebAuthn requests, if rp_id does not match origin, then send both origin's domain and the RP ID
- For WebAuthn requests (or protocols that do not have an RP ID equivalent), then if top_origin is set on the request, send both origin and top origin and display them accordingly.
Cf. 88b2e7cc0154a4085d6600d57939b535e94462af.
Contributor guide
Research direction
Read the WebAuthn cross-origin UI guidance and commit 88b2e7cc0154a4085d6600d57939b535e94462af first, then trace handling of rp_id, origin, and top_origin in the request path. Done means registrable domains are calculated with the Public Suffix List and cross-origin requests display both required identities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, rust
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100