311888 2026-04-09 18:38:48 -0700 Digital Credentials: CredentialsContainer::get() skips CredMan-level precondition checks 2026-07-13 20:42:54 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 268516 1 marcosc webkit-unassigned webkit-bug-importer oldest_to_newest 2198615 0 marcosc 2026-04-09 18:38:48 -0700 The Digital Credentials path in CredentialsContainer::get() bypasses several precondition checks that the Credential Management spec's "Request a Credential" algorithm (§2.5.1) requires before dispatching to [[DiscoverFromExternalSource]]. Gaps: 1. **Mediation conditional check (step 8a)**: The CredMan spec requires rejecting with TypeError when mediation is "conditional" and the credential type doesn't support it. Digital credentials don't support conditional mediation, but this wasn't checked in the CredMan layer. 2. **Permissions Policy check (step 11)**: The Permissions Policy check for `digital-credentials-get` was implemented inside DigitalCredential::discoverFromExternalSource() rather than in CredentialsContainer::get() where the spec requires it. 3. **"Fully active descendant of top-level traversable with user attention" (DC spec step 5)**: The implementation used Document::hasFocus() + visibilityState(), which is MORE restrictive than the spec requires. hasFocus() requires the focused frame to be a descendant of the calling document's frame, which breaks cross-origin iframes with `allow="digital-credentials-get"`. The spec's concept uses isFullyActive() + page-level visibility/focus (system attention on the top-level traversable). 4. **Wrong error code for concurrent requests**: CredentialRequestCoordinator rejected concurrent requests with InvalidStateError, but the CredMan spec requires NotAllowedError. Fix: - Add Document::isFullyActiveDescendantOfTopLevelTraversableWithUserAttention() using isFullyActive() + Page::isVisibleAndActive() - Move Permissions Policy and mediation conditional checks to CredentialsContainer::get() - Fix error code in CredentialRequestCoordinator from InvalidStateError to NotAllowedError Branch: eng/credman-dc-security-checks 2201329 1 webkit-bug-importer 2026-04-16 18:39:13 -0700 <rdar://problem/174971012>