Bug 318947

Summary: Digital Credentials: reject navigator.credentials.get() from opaque origins
Product: WebKit Reporter: Marcos Caceres <marcosc>
Component: WebCore Misc.Assignee: Marcos Caceres <marcosc>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 268516    

Marcos Caceres
Reported 2026-07-09 04:48:23 PDT
navigator.credentials.get({ digital }) currently proceeds from documents with an opaque origin (for example, an iframe sandboxed without allow-same-origin). Per w3c-fedid/digital-credentials#535, requests from opaque origins should be rejected. https://github.com/w3c-fedid/digital-credentials/pull/535
Attachments
Radar WebKit Bug Importer
Comment 1 2026-07-09 04:48:28 PDT
Marcos Caceres
Comment 2 2026-07-09 16:34:25 PDT
EWS
Comment 3 2026-07-15 15:57:03 PDT
Committed 317275@main (5da0c4f201f5): <https://commits.webkit.org/317275@main> Reviewed commits have been landed. Closing PR #69057 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.