Bug 314463

Summary:	Digital Credentials: use document origin (not top-level origin) for cross-origin iframe request validation
Product:	WebKit	Reporter:	Marcos Caceres <marcosc>
Component:	WebRTC	Assignee:	Marcos Caceres <marcosc>
Status:	NEW
Severity:	Normal	CC:	webkit-bug-importer, youennf
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:
Bug Blocks:	268516

Marcos Caceres

Reported 2026-05-08 22:17:09 PDT

When the Digital Credentials API is called from a cross-origin iframe, WebKit passes the top-level frame's origin to the platform for request validation. This causes signature validation failures because the request is cryptographically bound to the iframe's own origin. Chromium passes the iframe's origin, creating an interop issue. The W3C spec is being updated to clarify that both origins are needed: - Top-level origin: displayed in the credential chooser UI - Document (iframe) origin: used for request validation Spec PR: https://github.com/w3c-fedid/digital-credentials/pull/512 Spec issue: https://github.com/w3c-fedid/digital-credentials/issues/504 The fix is to pass document.securityOrigin() instead of document.topOrigin() to the validator in CredentialRequestCoordinator.cpp.

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2026-05-08 22:17:15 PDT

<rdar://problem/176628787>

Marcos Caceres

Comment 2 2026-05-08 22:25:29 PDT

<rdar://problem/176377059>

Marcos Caceres

Comment 3 2026-05-08 22:26:08 PDT

Pull request: https://github.com/WebKit/WebKit/pull/64596

Note You need to log in before you can comment on or make changes to this bug.