NEW314463
Digital Credentials: use document origin (not top-level origin) for cross-origin iframe request validation 
https://bugs.webkit.org/show_bug.cgi?id=314463
Summary Digital Credentials: use document origin (not top-level origin) for cross-ori...
Marcos Caceres
Reported 2026-05-08 22:17:09 PDT
When the Digital Credentials API is called from a cross-origin iframe, WebKit passes the top-level frame's origin to the platform for request validation. This causes signature validation failures because the request is cryptographically bound to the iframe's own origin. Chromium passes the iframe's origin, creating an interop issue. The W3C spec is being updated to clarify that both origins are needed: - Top-level origin: displayed in the credential chooser UI - Document (iframe) origin: used for request validation Spec PR: https://github.com/w3c-fedid/digital-credentials/pull/512 Spec issue: https://github.com/w3c-fedid/digital-credentials/issues/504 The fix is to pass document.securityOrigin() instead of document.topOrigin() to the validator in CredentialRequestCoordinator.cpp.
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-05-08 22:17:15 PDT
<rdar://problem/176628787>
Marcos Caceres
Comment 2 2026-05-08 22:25:29 PDT
<rdar://problem/176377059>
Marcos Caceres
Comment 3 2026-05-08 22:26:08 PDT
Pull request: https://github.com/WebKit/WebKit/pull/64596
Note You need to log in before you can comment on or make changes to this bug.