RESOLVED FIXED318947
Digital Credentials: reject navigator.credentials.get() from opaque origins 
https://bugs.webkit.org/show_bug.cgi?id=318947
Summary Digital Credentials: reject navigator.credentials.get() from opaque origins
Marcos Caceres
Reported 2026-07-09 04:48:23 PDT
navigator.credentials.get({ digital }) currently proceeds from documents with an opaque origin (for example, an iframe sandboxed without allow-same-origin). Per w3c-fedid/digital-credentials#535, requests from opaque origins should be rejected. https://github.com/w3c-fedid/digital-credentials/pull/535
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2026-07-09 04:48:28 PDT
<rdar://problem/181800688>
Marcos Caceres
Comment 2 2026-07-09 16:34:25 PDT
Pull request: https://github.com/WebKit/WebKit/pull/69057
EWS
Comment 3 2026-07-15 15:57:03 PDT
Committed 317275@main (5da0c4f201f5): <https://commits.webkit.org/317275@main> Reviewed commits have been landed. Closing PR #69057 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.