w3c / w3c/wot-scripting-api

Chose a particular security schema for an ExposedThing

Open
#299 15 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

for next iteration Security use case
Dominant language
HTML
Stars
45
Forks
21
PR merge metrics
No merged PRs in 30d

Description

As referred in https://github.com/w3c/wot-scripting-api/pull/289#issuecomment-775182073:

  • Applications should avoid entirely providing securityDefinitions
  • They (applications) may choose a particular definition using the schema field (globally or at form level)

This issue keeps track of how it would be possible to choose a particular scheme at the application level. One possible solution would be the definition of a proper function that lists all the possible SecurityScheme supported by a particular protocol binding and the runtime.

listSupportedSchemas(): Map<Protocol,SecuritySchemaDefinition[]>

Where Protocol could be the protocol URI scheme (i.e., HTTP,mqtt, ... )

However, I'm sure if it might have some security implications (fingerprinting?).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the PR #289 comment referenced by this issue and review the proposed listSupportedSchemas signature. Evaluate application-level selection of a SecurityScheme at global or form level, including the stated fingerprinting concern. Done means an application-level approach is agreed and documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.