Federated Identity Working Group - Activity in 2024
No matches.
Past meetings
Participants
-
1 participant joined.
-
SURESH POTTI (Microsoft Corporation) joined.
-
GitHub
w3c-fedid/FedCM
-
2 issues opened.
-
Consider adding an IDP chooser for unconnected IDPs w3c-fedid/FedCM#687, by @bvandersloot-mozilla.
-
Security considerations should be consistently organised by security risk? w3c-fedid/FedCM#685, by @philsmart.
-
-
5 issues received 11 new comments.
-
`IdentityProviderBranding` field `name` should provide lang and direction w3c-fedid/FedCM#679 (4 comments by @aphillips, @cbiesinger, @npm1)
-
Fields `name` and `given_name` have unclear usage w3c-fedid/FedCM#680 (3 comments by @aphillips, @cbiesinger)
-
Security considerations should be consistently organised by security risk? w3c-fedid/FedCM#685 (2 comments by @philsmart, @TallTed)
-
w3c-fedid/FedCM#80 (1 comment by @samuelgoto)
-
-
1 pull request opened.
-
Add single-get multi IDP support for passive mode w3c-fedid/FedCM#686, by @npm1.
-
-
2 pull requests received 9 new comments.
w3c-fedid/digital-credentials
-
2 issues opened.
-
Visualize transaction data in confirmation dialog w3c-fedid/digital-credentials#195, by @mobinauten.
-
What are the protocol identifier naming rules? w3c-fedid/digital-credentials#191, by @timcappalli.
-
-
2 issues closed.
-
Digital credential API should support requests for directed identifiers w3c-fedid/digital-credentials#126.
-
Presentation request format validation w3c-fedid/digital-credentials#152.
-
-
10 issues received 19 new comments.
-
Add a way to check what protocols are supported w3c-fedid/digital-credentials#168 (6 comments by @kdenhartog, @RByers, @samuelgoto, @sunetzacharias)
-
Relying Site/Verifier Lack of Scope or Restrictions w3c-fedid/digital-credentials#187 (4 comments by @timcappalli, @zoracon)
-
Describe trust signals in protocol registry w3c-fedid/digital-credentials#136 (2 comments by @npdoty, @RByers)
-
What are the protocol identifier naming rules? w3c-fedid/digital-credentials#191 (1 comment by @timcappalli)
-
[spec] Add blurb about wallets being a second user agent w3c-fedid/digital-credentials#190 (1 comment by @timcappalli)
-
Don't require CM "mediation" to be specified explicitly (always 'required' for DC). w3c-fedid/digital-credentials#177 (1 comment by @RByers)
-
Digital credential API should support requests for directed identifiers w3c-fedid/digital-credentials#126 (1 comment by @timcappalli)
-
Presentation request format validation w3c-fedid/digital-credentials#152 (1 comment by @timcappalli)
-
-
1 pull request opened.
-
Add initial intro text w3c-fedid/digital-credentials#193, by @timcappalli.
-
-
1 pull request merged.
-
Add initial content to Security and Privacy Considerations sections. w3c-fedid/digital-credentials#189.
-
-
3 pull requests received 21 new comments.
-
Add initial content to Security and Privacy Considerations sections. w3c-fedid/digital-credentials#189 (11 comments by @msporny, @npdoty, @RByers, @simoneonofri)
-
Add initial intro text w3c-fedid/digital-credentials#193 (9 comments by @MasterKale, @samuelgoto, @TallTed, @timcappalli)
-
w3c-fedid/digital-credentials#192 (1 comment by @w3cbot)
-
w3c-fedid/login-status
-
1 issue received 3 new comments.
-
TPAC - Future of Login Status w3c-fedid/login-status#8 (3 comments by @annevk, @johannhof, @johnwilander)
-
w3c-fedid/Administration
-
1 pull request received 11 new comments.
-
Update proposals-CG-WG.md w3c-fedid/Administration#12 (11 comments by @npm1, @samuelgoto, @TallTed, @wseltzer)
-
Past meetings
Participants
-
1 participant joined.
-
Siddhartha Pandey (Microsoft Corporation) joined.
-
-
2 participants left.
-
Daniel Buchner (Block, Inc.) left.
-
Timothy Shamilov (Block, Inc.) left.
-
-
1 organization joined.
-
MITRE Corporation joined.
-
-
1 organization left.
-
Block, Inc. left.
-
GitHub
w3c-fedid/FedCM
-
5 issues opened.
-
`Get Title` doesn't have language or direction metadata w3c-fedid/FedCM#682, by @aphillips.
-
Allow for language negotiation or localization of privacy policy and TOS? w3c-fedid/FedCM#681, by @aphillips.
-
Fields `name` and `given_name` have unclear usage w3c-fedid/FedCM#680, by @aphillips.
-
`IdentityProviderBranding` field `name` should provide lang and direction w3c-fedid/FedCM#679, by @aphillips.
-
-
6 issues received 9 new comments.
-
Clarify the necessity to protect against device exfil attacks w3c-fedid/FedCM#664 (3 comments by @cbiesinger, @philsmart)
-
Allow for language negotiation or localization of privacy policy and TOS? w3c-fedid/FedCM#681 (1 comment by @cbiesinger)
-
In passive mode, clarify in the spec that the engine can make choices of what and whether to render prompts w3c-fedid/FedCM#675 (1 comment by @cbiesinger)
-
-
4 pull requests opened.
-
Remove 'signed assertions about the user' w3c-fedid/FedCM#684, by @philsmart.
-
Update build-validate-publish.yaml w3c-fedid/FedCM#683, by @npm1.
-
Specify "Use another account". w3c-fedid/FedCM#678, by @cbiesinger.
-
Allow user agent to wait or reject the request before any fetch w3c-fedid/FedCM#676, by @npm1.
-
-
4 pull requests merged.
-
Specify multiple configURLs w3c-fedid/FedCM#667.
-
Specify the continuation API w3c-fedid/FedCM#662.
-
Specify the mode API w3c-fedid/FedCM#660.
-
Update build-validate-publish.yaml w3c-fedid/FedCM#683.
-
-
8 pull requests received 74 new comments.
-
Specify "Use another account". w3c-fedid/FedCM#678 (29 comments by @cbiesinger, @domenic, @hlflanagan, @npm1, @TallTed)
-
Specify the continuation API w3c-fedid/FedCM#662 (14 comments by @cbiesinger, @hlflanagan, @npm1, @philsmart, @samuelgoto)
-
Allow user agent to wait or reject the request before any fetch w3c-fedid/FedCM#676 (4 comments by @cbiesinger, @npm1, @TallTed)
-
Replace link to Explainer with Developer Documentation w3c-fedid/FedCM#674 (3 comments by @sandormajor, @TallTed, @w3cbot)
-
w3c-fedid/Administration
-
1 issue opened.
-
Stages are unaligned with TC39 and WHATWG conceptually w3c-fedid/Administration#11, by @bvandersloot-mozilla.
-
-
1 issue received 1 new comment.
-
Stages are unaligned with TC39 and WHATWG conceptually w3c-fedid/Administration#11 (1 comment by @hlflanagan)
-
-
1 pull request opened.
-
Update proposals-CG-WG.md w3c-fedid/Administration#12, by @hlflanagan.
-
-
1 pull request received 5 new comments.
w3c-fedid/digital-credentials
-
1 issue opened.
-
[spec] Add blurb about wallets being a second user agent w3c-fedid/digital-credentials#190, by @timcappalli.
-
-
6 issues closed.
-
Protocol extensibility: where should we draw the line between what gets parsed and validated by the browser? w3c-fedid/digital-credentials#161.
-
Fold in Mobile Document Request API into spec, so we can do requests w3c-fedid/digital-credentials#67.
-
Clearly separate presentation of issuer-signed Credentials from User Authentication Event w3c-fedid/digital-credentials#10.
-
[Discuss] Solution scope w3c-fedid/digital-credentials#33.
-
[Discuss] Query languages w3c-fedid/digital-credentials#31.
-
[spec] Add additional examples w3c-fedid/digital-credentials#181.
-
-
17 issues received 25 new comments.
-
Presentation request format validation w3c-fedid/digital-credentials#152 (4 comments by @marcoscaceres, @samuelgoto, @timcappalli)
-
Top level request object structure should be fully defined by protocol identifier w3c-fedid/digital-credentials#185 (4 comments by @bc-pi, @Sakurann, @timcappalli)
-
Add a way to check what protocols are supported w3c-fedid/digital-credentials#168 (2 comments by @kdenhartog, @timcappalli)
-
Relying Site/Verifier Lack of Scope or Restrictions w3c-fedid/digital-credentials#187 (2 comments by @npdoty, @zoracon)
-
Protocol extensibility: where should we draw the line between what gets parsed and validated by the browser? w3c-fedid/digital-credentials#161 (1 comment by @samuelgoto)
-
w3c-fedid/digital-credentials#67 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#10 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#33 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#31 (1 comment by @timcappalli)
-
Should we have a common and interoperable definition of request types and their privacy properties? w3c-fedid/digital-credentials#117 (1 comment by @timcappalli)
-
[spec] add statement about responses with PII MUST be encrypted w3c-fedid/digital-credentials#124 (1 comment by @timcappalli)
-
Describe trust signals in protocol registry w3c-fedid/digital-credentials#136 (1 comment by @timcappalli)
-
Don't require CM "mediation" to be specified explicitly (always 'required' for DC). w3c-fedid/digital-credentials#177 (1 comment by @timcappalli)
-
-
1 pull request opened.
-
Add initial content to Security and Privacy Considerations sections. w3c-fedid/digital-credentials#189, by @msporny.
-
-
1 pull request merged.
-
Add additional use cases and examples to intro w3c-fedid/digital-credentials#186.
-
-
3 pull requests received 6 new comments.
-
Require JSON serialization checks coming in w3c-fedid/digital-credentials#179 (4 comments by @marcoscaceres, @timcappalli)
-
Add initial content to Security and Privacy Considerations sections. w3c-fedid/digital-credentials#189 (1 comment by @simoneonofri)
-
w3c-fedid/digital-credentials#188 (1 comment by @w3cbot)
-
w3c-fedid/login-status
-
1 issue opened.
-
Owner Carlos Alberto Sacaza Palacio w3c-fedid/login-status#9, by @ChiefUSA.
-
-
1 issue closed.
-
Owner Carlos Alberto Sacaza Palacio w3c-fedid/login-status#9.
-
-
1 issue received 1 new comment.
Past meetings
GitHub
w3c-fedid/FedCM
-
6 issues opened.
-
Horizontal Review - i18n w3c-fedid/FedCM#673, by @hlflanagan.
-
Profile pictures have to be downloaded before filtering w3c-fedid/FedCM#672, by @cbiesinger.
-
Auto-grant a passkey `conditional` create w3c-fedid/FedCM#671, by @samuelgoto.
-
Thoughts on FedCM full vs FedCM lite w3c-fedid/FedCM#665, by @cbiesinger.
-
Clarify the necessity to protect against device exfil attacks w3c-fedid/FedCM#664, by @gioele-antoci.
-
Secretle w3c-fedid/FedCM#663, by @Resul0012.
-
-
3 issues closed.
-
Secretle w3c-fedid/FedCM#663.
-
Access to FedCM available options (suitable to site) w3c-fedid/FedCM#451.
-
9 issues received 29 new comments.
-
Auto-grant a passkey `conditional` create w3c-fedid/FedCM#671 (11 comments by @cbiesinger, @npm1, @philsmart, @timcappalli)
-
Clarify the necessity to protect against device exfil attacks w3c-fedid/FedCM#664 (1 comment by @samuelgoto)
-
Consider using `application/json` rather than `application/x-www-form-urlencoded` in the `id_assertion_endpoint` w3c-fedid/FedCM#644 (1 comment by @elf-pavlik)
-
w3c-fedid/FedCM#451 (1 comment by @tttzach)
-
-
9 pull requests opened.
-
Replace link to Explainer with Developer Documentation w3c-fedid/FedCM#674, by @sandormajor.
-
Download profile pictures before filtering accounts w3c-fedid/FedCM#670, by @cbiesinger.
-
Specify account labels w3c-fedid/FedCM#669, by @cbiesinger.
-
Specify the fields API w3c-fedid/FedCM#668, by @cbiesinger.
-
Specify multiple configURLs w3c-fedid/FedCM#667, by @cbiesinger.
-
Handle errors from JSON serialization. w3c-fedid/FedCM#666, by @cbiesinger.
-
Specify the continuation API w3c-fedid/FedCM#662, by @cbiesinger.
-
Specify the params API w3c-fedid/FedCM#661, by @cbiesinger.
-
Specify the mode API w3c-fedid/FedCM#660, by @tttzach.
-
-
2 pull requests merged.
-
Handle errors from JSON serialization. w3c-fedid/FedCM#666.
-
Specify the params API w3c-fedid/FedCM#661.
-
-
10 pull requests received 170 new comments.
-
Specify the mode API w3c-fedid/FedCM#660 (77 comments by @bvandersloot-mozilla, @cbiesinger, @hlflanagan, @npm1, @philsmart, @samuelgoto, @TallTed, @tttzach, @wseltzer, @yi-gu)
-
Specify the params API w3c-fedid/FedCM#661 (22 comments by @bvandersloot-mozilla, @cbiesinger, @samuelgoto, @TallTed, @wseltzer)
-
Specify the continuation API w3c-fedid/FedCM#662 (21 comments by @bvandersloot-mozilla, @cbiesinger, @philsmart, @samuelgoto, @ThisIsMissEm, @wseltzer, @yi-gu)
-
Download profile pictures before filtering accounts w3c-fedid/FedCM#670 (4 comments by @cbiesinger, @npm1, @TallTed)
-
w3c-fedid/digital-credentials
-
9 issues opened.
-
Relying Site/Verifier Lack of Scope or Restrictions w3c-fedid/digital-credentials#187, by @zoracon.
-
Top level request object structure should be fully defined by protocol identifier w3c-fedid/digital-credentials#185, by @timcappalli.
-
write security considerations w3c-fedid/digital-credentials#184, by @npdoty.
-
Write privacy considerations w3c-fedid/digital-credentials#183, by @npdoty.
-
[spec] Add initial intro text w3c-fedid/digital-credentials#182, by @timcappalli.
-
[spec] Add additional examples w3c-fedid/digital-credentials#181, by @timcappalli.
-
Don't require CM "mediation" to be specified explicitly (always 'required' for DC). w3c-fedid/digital-credentials#177, by @samuelgoto.
-
Allow mediation = "optional" w3c-fedid/digital-credentials#175, by @samuelgoto.
-
Doc outdated w3c-fedid/digital-credentials#174, by @fanysoft.
-
-
5 issues closed.
-
Allow mediation = "optional" w3c-fedid/digital-credentials#175.
-
Update example to show feature detection w3c-fedid/digital-credentials#170.
-
Links to sample code do not work w3c-fedid/digital-credentials#169.
-
Safeguarding devs from potential per-protocol use of Uint8Array values w3c-fedid/digital-credentials#171.
-
Doc outdated w3c-fedid/digital-credentials#174.
-
-
12 issues received 39 new comments.
-
Support for issuance w3c-fedid/digital-credentials#167 (11 comments by @dlongley, @samuelgoto, @timcappalli)
-
Add a way to check what protocols are supported w3c-fedid/digital-credentials#168 (6 comments by @leecam, @MasterKale, @npdoty, @samuelgoto, @timcappalli)
-
[spec] Add additional examples w3c-fedid/digital-credentials#181 (5 comments by @marcoscaceres, @MasterKale, @msporny, @samuelgoto)
-
Don't require CM "mediation" to be specified explicitly (always 'required' for DC). w3c-fedid/digital-credentials#177 (3 comments by @marcoscaceres, @timcappalli)
-
Allow mediation = "optional" w3c-fedid/digital-credentials#175 (3 comments by @cbiesinger, @samuelgoto)
-
Top level request object structure should be fully defined by protocol identifier w3c-fedid/digital-credentials#185 (2 comments by @bc-pi, @OR13)
-
Safeguarding devs from potential per-protocol use of Uint8Array values w3c-fedid/digital-credentials#171 (2 comments by @leecam, @MasterKale)
-
[spec] DigitalCredentialRequestOptions and DigitalCredential objects must be JSON serializable w3c-fedid/digital-credentials#125 (1 comment by @leecam)
-
-
5 pull requests opened.
-
Add additional use cases and examples to intro w3c-fedid/digital-credentials#186, by @timcappalli.
-
chore: update short name to "digital-credentials" w3c-fedid/digital-credentials#180, by @timcappalli.
-
Require JSON serialization checks coming in w3c-fedid/digital-credentials#179, by @timcappalli.
-
Add mediation: "required" to explainer example w3c-fedid/digital-credentials#178, by @timcappalli.
-
Allow mediation="optional" w3c-fedid/digital-credentials#176, by @samuelgoto.
-
-
3 pull requests merged.
-
chore: update short name to "digital-credentials" w3c-fedid/digital-credentials#180.
-
Add mediation: "required" to explainer example w3c-fedid/digital-credentials#178.
-
Update explainer to include feature detection and new syntax w3c-fedid/digital-credentials#173.
-
-
1 pull request closed.
-
Allow mediation="optional" w3c-fedid/digital-credentials#176.
-
-
7 pull requests received 15 new comments.
-
Require JSON serialization checks coming in w3c-fedid/digital-credentials#179 (7 comments by @marcoscaceres, @samuelgoto, @timcappalli)
-
Add additional use cases and examples to intro w3c-fedid/digital-credentials#186 (2 comments by @samuelgoto, @TallTed)
-
w3c-fedid/digital-credentials#172 (1 comment by @w3cbot)
-
Update explainer to include feature detection and new syntax w3c-fedid/digital-credentials#173 (1 comment by @samuelgoto)
-
w3c-fedid/login-status
-
1 issue received 2 new comments.
-
TPAC - Future of Login Status w3c-fedid/login-status#8 (2 comments by @bvandersloot-mozilla, @samuelgoto)
-
Past meetings
-
4 meetings.
Participants
-
12 participants joined.
-
George Fletcher (W3C Invited Experts) joined.
-
Steve Venema (Microsoft Corporation) joined.
-
Duy-Tung LUU (CANTON CONSULTING) joined.
-
John Wilander (Apple Inc.) joined.
-
Ricky Mondello (Apple Inc.) joined.
-
Hicham Lozi (Apple Inc.) joined.
-
JP Hribovsek (Apple Inc.) joined.
-
Marcos Caceres (Apple Inc.) joined.
-
Theresa O'Connor (Apple Inc.) joined.
-
Joshua Thomas (Ignite Retail Technology) joined.
-
Zane Durkin (Ignite Retail Technology) joined.
-
Brian McManus (Ignite Retail Technology) joined.
-
-
4 organizations joined.
-
Capital One Discover Network joined.
-
CANTON CONSULTING joined.
-
Apple Inc. joined.
-
Ignite Retail Technology joined.
-
GitHub
w3c-fedid/FedCM
-
5 issues opened.
-
Potential creation of (client_id, user) pairs through manipulated client_metadata links w3c-fedid/FedCM#659, by @togamid.
-
Horizontal Review preparation w3c-fedid/FedCM#652, by @wseltzer.
-
did think and communicate w3c-fedid/FedCM#649, by @Smy0521.
-
User Info API vs. preventSilentAccess w3c-fedid/FedCM#645, by @johannhof.
-
-
10 issues closed.
-
did think and communicate w3c-fedid/FedCM#649.
-
PR Preview broke w3c-fedid/FedCM#643.
-
Break the Login Status API spec out of the FedCM spec w3c-fedid/FedCM#641.
-
The Login Status API Set-Login header in a Disconnect Endpoint Response w3c-fedid/FedCM#558.
-
FedCM within Iframe and User interaction requirements w3c-fedid/FedCM#518.
-
Explainer is out of date. Should we remove it? w3c-fedid/FedCM#622.
-
Missing Attack Scenario: User Agent colluding with an IDP or RP w3c-fedid/FedCM#86.
-
Missing interactions in sign up flow w3c-fedid/FedCM#243.
-
Define identity in the spec w3c-fedid/FedCM#137.
-
Rename sign-up algorithm? w3c-fedid/FedCM#126.
-
-
1 issue reopened.
-
Break the Login Status API spec out of the FedCM spec w3c-fedid/FedCM#641, by @npm1.
-
-
19 issues received 45 new comments.
-
Why must SameSite=none? w3c-fedid/FedCM#587 (11 comments by @anderspitman, @cbiesinger, @npm1, @samuelgoto)
-
Allow selecting an account without email addresses w3c-fedid/FedCM#639 (6 comments by @npm1, @samuelgoto, @timcappalli)
-
Consider using `application/json` rather than `application/x-www-form-urlencoded` in the `id_assertion_endpoint` w3c-fedid/FedCM#644 (3 comments by @bc-pi, @elf-pavlik, @panva)
-
Break the Login Status API spec out of the FedCM spec w3c-fedid/FedCM#641 (2 comments by @npm1, @samuelgoto)
-
Potential creation of (client_id, user) pairs through manipulated client_metadata links w3c-fedid/FedCM#659 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#467 (1 comment by @wseltzer)
-
Allow IDPs to use multiple config files within an eTLD+1 w3c-fedid/FedCM#552 (1 comment by @wseltzer)
-
Allowing IDPs to expose different account lists in different contexts w3c-fedid/FedCM#553 (1 comment by @wseltzer)
-
w3c-fedid/FedCM#485 (1 comment by @mathiasbynens)
-
The Login Status API Set-Login header in a Disconnect Endpoint Response w3c-fedid/FedCM#558 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#518 (1 comment by @tttzach)
-
w3c-fedid/FedCM#86 (1 comment by @npm1)
-
w3c-fedid/FedCM#243 (1 comment by @tttzach)
-
w3c-fedid/FedCM#137 (1 comment by @npm1)
-
w3c-fedid/FedCM#126 (1 comment by @samuelgoto)
-
-
8 pull requests opened.
-
[test] Update index.bs 2 w3c-fedid/FedCM#657, by @simoneonofri.
-
[test] Update index.bs w3c-fedid/FedCM#656, by @simoneonofri.
-
[test] Update index.bs 2 w3c-fedid/FedCM#655, by @simoneonofri.
-
[test] Update index.bs w3c-fedid/FedCM#654, by @simoneonofri.
-
Update index.bs (test) w3c-fedid/FedCM#653, by @wseltzer.
-
Disambiguate [=remote end steps=] w3c-fedid/FedCM#651, by @cbiesinger.
-
chore: update fedcm links w3c-fedid/FedCM#650, by @Delta456.
-
Remove the Login Status API spec from the FedCM repo, now that it moved w3c-fedid/FedCM#648, by @samuelgoto.
-
-
5 pull requests merged.
-
chore: update fedcm links w3c-fedid/FedCM#650.
-
Update index.bs (test) w3c-fedid/FedCM#653.
-
Disambiguate [=remote end steps=] w3c-fedid/FedCM#651.
-
Remove the Login Status API spec from the FedCM repo, now that it moved w3c-fedid/FedCM#648.
-
Break the Login Status API out of the FedCM spec w3c-fedid/FedCM#642.
-
-
4 pull requests closed.
-
[test] Update index.bs w3c-fedid/FedCM#656.
-
[test] Update index.bs 2 w3c-fedid/FedCM#657.
-
[test] Update index.bs w3c-fedid/FedCM#654.
-
[test] Update index.bs 2 w3c-fedid/FedCM#655.
-
-
6 pull requests received 38 new comments.
-
Break the Login Status API out of the FedCM spec w3c-fedid/FedCM#642 (20 comments by @cbiesinger, @npm1, @samuelgoto)
-
Specify the webdriver command to open terms of service and privacy po… w3c-fedid/FedCM#610 (3 comments by @cbiesinger)
-
w3c-fedid/FedCM#498 (1 comment by @npm1)
-
w3c-fedid/FedCM#523 (1 comment by @npm1)
-
w3c-fedid/meetings
-
2 pull requests opened.
-
Add slides for pre-read w3c-fedid/meetings#2, by @samuelgoto.
-
Add a couple more proposals to advance, time allowing w3c-fedid/meetings#1, by @samuelgoto.
-
-
1 pull request merged.
-
Add slides for pre-read w3c-fedid/meetings#2.
-
-
1 pull request closed.
-
Add a couple more proposals to advance, time allowing w3c-fedid/meetings#1.
-
-
1 pull request received 1 new comment.
w3c-fedid/digital-credentials
-
6 issues opened.
-
Safeguarding devs from potential per-protocol use of Uint8Array values w3c-fedid/digital-credentials#171, by @MasterKale.
-
Update example to show feature detection w3c-fedid/digital-credentials#170, by @RByers.
-
Links to sample code do not work w3c-fedid/digital-credentials#169, by @huhubi.
-
Add a way to check what protocols are supported w3c-fedid/digital-credentials#168, by @marcoscaceres.
-
Support for issuance w3c-fedid/digital-credentials#167, by @samuelgoto.
-
What is the defined trust boundary between the user, wallet, and browser? w3c-fedid/digital-credentials#166, by @kdenhartog.
-
-
6 issues closed.
-
Rename "providers" to "presentationRequests" or just "requests"? w3c-fedid/digital-credentials#155.
-
Using CryptoKey for public keys - what are the restrictions? w3c-fedid/digital-credentials#56.
-
[Discuss] Relationship between identity credentials, passkeys, and federation w3c-fedid/digital-credentials#25.
-
Add clientData w3c-fedid/digital-credentials#95.
-
Requirements and Objectives w3c-fedid/digital-credentials#52.
-
Integrate with FedCM? w3c-fedid/digital-credentials#23.
-
-
13 issues received 22 new comments.
-
What is the defined trust boundary between the user, wallet, and browser? w3c-fedid/digital-credentials#166 (5 comments by @bvandersloot-mozilla, @dlongley, @TomCJones)
-
Update example to show feature detection w3c-fedid/digital-credentials#170 (3 comments by @RByers, @timcappalli)
-
Protocol extensibility: where should we draw the line between what gets parsed and validated by the browser? w3c-fedid/digital-credentials#161 (3 comments by @jogu, @samuelgoto, @TomCJones)
-
[spec] DigitalCredentialRequestOptions and DigitalCredential objects must be JSON serializable w3c-fedid/digital-credentials#125 (1 comment by @timcappalli)
-
Safeguarding devs from potential per-protocol use of Uint8Array values w3c-fedid/digital-credentials#171 (1 comment by @MasterKale)
-
w3c-fedid/digital-credentials#25 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#52 (1 comment by @timcappalli)
-
Add a way to check what protocols are supported w3c-fedid/digital-credentials#168 (1 comment by @msporny)
-
w3c-fedid/digital-credentials#23 (1 comment by @timcappalli)
-
-
3 pull requests opened.
-
Update explainer to include feature detection and new syntax w3c-fedid/digital-credentials#173, by @timcappalli.
-
change providers to requests w3c-fedid/digital-credentials#165, by @marcoscaceres.
-
Drop navigator.identity namespace w3c-fedid/digital-credentials#164, by @marcoscaceres.
-
-
2 pull requests merged.
-
change providers to requests w3c-fedid/digital-credentials#165.
-
Drop navigator.identity namespace w3c-fedid/digital-credentials#164.
-
-
4 pull requests received 32 new comments.
-
change providers to requests w3c-fedid/digital-credentials#165 (25 comments by @bc-pi, @marcoscaceres, @msporny, @samuelgoto, @timcappalli)
-
Drop navigator.identity namespace w3c-fedid/digital-credentials#164 (5 comments by @marcoscaceres, @samuelgoto)
-
Update explainer to include feature detection and new syntax w3c-fedid/digital-credentials#173 (1 comment by @timcappalli)
-
w3c-fedid/login-status
-
1 issue opened.
-
TPAC - Future of Login Status w3c-fedid/login-status#8, by @johannhof.
-
-
3 pull requests opened.
-
Testing github workflows w3c-fedid/login-status#7, by @samuelgoto.
-
Add workflows w3c-fedid/login-status#6, by @samuelgoto.
-
Move the spec from the FedCM repo w3c-fedid/login-status#5, by @samuelgoto.
-
-
3 pull requests merged.
-
Testing github workflows w3c-fedid/login-status#7.
-
Add workflows w3c-fedid/login-status#6.
-
Move the spec from the FedCM repo w3c-fedid/login-status#5.
-
-
1 pull request received 4 new comments.
w3c-fedid/.github
-
3 pull requests opened.
-
Point readers to the table, rather than inline. w3c-fedid/.github#3, by @samuelgoto.
-
Add lightweight to the list of stage 1 proposals w3c-fedid/.github#2, by @samuelgoto.
-
Add a few more proposals that are in Stage 1 but don't have repos w3c-fedid/.github#1, by @samuelgoto.
-
-
3 pull requests merged.
-
Point readers to the table, rather than inline. w3c-fedid/.github#3.
-
Add a few more proposals that are in Stage 1 but don't have repos w3c-fedid/.github#1.
-
Add lightweight to the list of stage 1 proposals w3c-fedid/.github#2.
-
-
2 pull requests received 4 new comments.
-
Point readers to the table, rather than inline. w3c-fedid/.github#3 (3 comments by @samuelgoto, @wseltzer)
-
Add a few more proposals that are in Stage 1 but don't have repos w3c-fedid/.github#1 (1 comment by @samuelgoto)
-
w3c-fedid/Administration
-
10 pull requests opened.
-
A few minor clarificaitons w3c-fedid/Administration#10, by @samuelgoto.
-
Use the W3C's definition of sufficient implementation experience w3c-fedid/Administration#9, by @samuelgoto.
-
Reconcile the W3C documents with the Stages better w3c-fedid/Administration#8, by @samuelgoto.
-
Merge the section of "What happens if accept" with the section "What'… w3c-fedid/Administration#7, by @samuelgoto.
-
Revert "Small visual clarification: use checkboxes for items rather than list items" w3c-fedid/Administration#6, by @wseltzer.
-
Clarifications w3c-fedid/Administration#5, by @samuelgoto.
-
Small visual clarification: use checkboxes for items rather than list items w3c-fedid/Administration#4, by @samuelgoto.
-
Update proposals-CG-WG.md w3c-fedid/Administration#3, by @samuelgoto.
-
Update proposals-CG-WG.md w3c-fedid/Administration#2, by @samuelgoto.
-
Update proposals-CG-WG.md w3c-fedid/Administration#1, by @samuelgoto.
-
-
9 pull requests merged.
-
A few minor clarificaitons w3c-fedid/Administration#10.
-
Reconcile the W3C documents with the Stages better w3c-fedid/Administration#8.
-
Use the W3C's definition of sufficient implementation experience w3c-fedid/Administration#9.
-
Merge the section of "What happens if accept" with the section "What'… w3c-fedid/Administration#7.
-
Clarifications w3c-fedid/Administration#5.
-
Small visual clarification: use checkboxes for items rather than list items w3c-fedid/Administration#4.
-
Update proposals-CG-WG.md w3c-fedid/Administration#3.
-
Update proposals-CG-WG.md w3c-fedid/Administration#2.
-
Update proposals-CG-WG.md w3c-fedid/Administration#1.
-
-
1 pull request closed.
-
Revert "Small visual clarification: use checkboxes for items rather than list items" w3c-fedid/Administration#6.
-
-
7 pull requests received 40 new comments.
-
Clarifications w3c-fedid/Administration#5 (31 comments by @hlflanagan, @npm1, @samuelgoto, @TallTed)
-
Merge the section of "What happens if accept" with the section "What'… w3c-fedid/Administration#7 (2 comments by @TallTed)
-
Revert "Small visual clarification: use checkboxes for items rather than list items" w3c-fedid/Administration#6 (1 comment by @wseltzer)
-
Small visual clarification: use checkboxes for items rather than list items w3c-fedid/Administration#4 (1 comment by @samuelgoto)
-
TR publications
-
1 document published.
-
Federated Credential Management API published as a First Public Working Draft. History of Federated Credential Management API
-
Past meetings
Participants
-
4 participants joined.
-
Jin Wen (OneSpan) joined.
-
Rolf Lindemann (OneSpan) joined.
-
Carl Prosack (Department of Homeland Security) joined.
-
Mohamed Amir Yosef (Google LLC) joined.
-
-
1 participant left.
-
Ri Xu (Alibaba Group) left.
-
-
1 organization joined.
-
OneSpan joined.
-
GitHub
w3c-fedid/FedCM
-
8 issues opened.
-
PR Preview broke w3c-fedid/FedCM#643, by @npm1.
-
Break the Login Status API spec out of the FedCM spec w3c-fedid/FedCM#641, by @samuelgoto.
-
Allow selecting an account without email addresses w3c-fedid/FedCM#639, by @samuelgoto.
-
Specification Metadata outdated? w3c-fedid/FedCM#632, by @lukewarlow.
-
Providers list constraint violations should not result in a NetworkError w3c-fedid/FedCM#628, by @timcappalli.
-
Add webdriver command to open PP/TOS w3c-fedid/FedCM#627, by @npm1.
-
PP/TOS requirements are different from auto reauthentication w3c-fedid/FedCM#626, by @npm1.
-
Returning accounts go first in getUserInfo w3c-fedid/FedCM#625, by @npm1.
-
-
13 issues closed.
-
Consider lifting IdentityCredential out of FedCM spec w3c-fedid/FedCM#457.
-
Allow setting IDP login status from same-site subresources w3c-fedid/FedCM#537.
-
Disallow multiple get() calls at the same time w3c-fedid/FedCM#340.
-
Security Threat Model w3c-fedid/FedCM#28.
-
login fencedframes: exfiltration through show/hide signal? w3c-fedid/FedCM#65.
-
Multiple IDP support requires patching the HTML spec w3c-fedid/FedCM#440.
-
PP/TOS requirements are different from auto reauthentication w3c-fedid/FedCM#626.
-
Enforce CORS on the Identity Assertions endpoint w3c-fedid/FedCM#428.
-
Should getUserInfo() be under IdentityProvider? w3c-fedid/FedCM#476.
-
Directed Identifiers - Remarks w3c-fedid/FedCM#35.
-
Authorizing non-profile oauth scopes w3c-fedid/FedCM#477.
-
-
19 issues received 33 new comments.
-
Allow selecting an account without email addresses w3c-fedid/FedCM#639 (12 comments by @aaronpk, @bc-pi, @npm1, @samuelgoto, @TallTed)
-
w3c-fedid/FedCM#352 (2 comments by @cbiesinger)
-
w3c-fedid/FedCM#537 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#380 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#366 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#457 (1 comment by @mknowles36)
-
w3c-fedid/FedCM#340 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#28 (1 comment by @npm1)
-
w3c-fedid/FedCM#364 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#440 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#11 (1 comment by @npm1)
-
w3c-fedid/FedCM#476 (1 comment by @tttzach)
-
w3c-fedid/FedCM#35 (1 comment by @samuelgoto)
-
IdP Registration API: should the browser reveal to the RP when no IdP has registered before? w3c-fedid/FedCM#605 (1 comment by @npm1)
-
Providers list constraint violations should not result in a NetworkError w3c-fedid/FedCM#628 (1 comment by @npm1)
-
w3c-fedid/FedCM#477 (1 comment by @samuelgoto)
-
-
8 pull requests opened.
-
Break the Login Status API out of the FedCM spec w3c-fedid/FedCM#642, by @samuelgoto.
-
Use the Editor's Draft boilerplate on fedid-wg.github.io/FedCM w3c-fedid/FedCM#638, by @simoneonofri.
-
[link-validator] Missing file context-api.md w3c-fedid/FedCM#637, by @simoneonofri.
-
[link-validator] s/fedid/w3c-fedid/ w3c-fedid/FedCM#636, by @simoneonofri.
-
Fix the link to the Web Platform Tests w3c-fedid/FedCM#635, by @samuelgoto.
-
FPWD preparation w3c-fedid/FedCM#634, by @simoneonofri.
-
Update Metadata to reflect migration to WG w3c-fedid/FedCM#633, by @lukewarlow.
-
Add additional tagged issues w3c-fedid/FedCM#630, by @wseltzer.
-
-
10 pull requests merged.
-
[link-validator] Missing file context-api.md w3c-fedid/FedCM#637.
-
Use the Editor's Draft boilerplate on fedid-wg.github.io/FedCM w3c-fedid/FedCM#638.
-
[link-validator] s/fedid/w3c-fedid/ w3c-fedid/FedCM#636.
-
Relax the login status requirement from same-origin to same-site w3c-fedid/FedCM#538.
-
Fix FedCM connection status computations w3c-fedid/FedCM#526.
-
Change ID assertion endpoint mode to CORS w3c-fedid/FedCM#547.
-
Fix the link to the Web Platform Tests w3c-fedid/FedCM#635.
-
FPWD preparation w3c-fedid/FedCM#634.
-
Add list of FPWD critical issues w3c-fedid/FedCM#623.
-
Add additional tagged issues w3c-fedid/FedCM#630.
-
-
2 pull requests closed.
-
Update Metadata to reflect migration to WG w3c-fedid/FedCM#633.
-
Fix assertion in DiscoverFromExternalSource algorithm w3c-fedid/FedCM#460.
-
-
11 pull requests received 56 new comments.
-
Break the Login Status API out of the FedCM spec w3c-fedid/FedCM#642 (17 comments by @cbiesinger, @npm1, @samuelgoto)
-
[link-validator] Missing file context-api.md w3c-fedid/FedCM#637 (5 comments by @npm1, @simoneonofri)
-
Add list of FPWD critical issues w3c-fedid/FedCM#623 (5 comments by @bvandersloot-mozilla, @samuelgoto, @wseltzer)
-
Update Metadata to reflect migration to WG w3c-fedid/FedCM#633 (2 comments by @lukewarlow, @simoneonofri)
-
w3c-fedid/FedCM#460 (1 comment by @npm1)
-
w3c-fedid/FedCM#538 (1 comment by @npm1)
-
w3c-fedid/FedCM#526 (1 comment by @bvandersloot-mozilla)
-
w3c-fedid/digital-credentials
-
5 issues opened.
-
Protocol extensibility: where should we draw the line between what gets parsed and validated by the browser? w3c-fedid/digital-credentials#161, by @samuelgoto.
-
Handling various origin types w3c-fedid/digital-credentials#160, by @marcoscaceres.
-
Handling ongoing operations / subsequent call to get() w3c-fedid/digital-credentials#159, by @marcoscaceres.
-
Rename "providers" to "presentationRequests" or just "requests"? w3c-fedid/digital-credentials#155, by @marcoscaceres.
-
Presentation request format validation w3c-fedid/digital-credentials#152, by @marcoscaceres.
-
-
6 issues closed.
-
Credential request options mediation requirement w3c-fedid/digital-credentials#147.
-
Web Platform Tests: refactoring digitial-credentials.tentative.https.html w3c-fedid/digital-credentials#118.
-
What should be the data type for the response? w3c-fedid/digital-credentials#119.
-
IdentityRequestProvider should be renamed something like "options" or "details" w3c-fedid/digital-credentials#70.
-
Expressing requested claims in the Verifiable Credentials example w3c-fedid/digital-credentials#5.
-
parameters not specific to the credential format w3c-fedid/digital-credentials#7.
-
-
26 issues received 54 new comments.
-
Rename "providers" to "presentationRequests" or just "requests"? w3c-fedid/digital-credentials#155 (9 comments by @marcoscaceres, @samuelgoto, @timcappalli)
-
Presentation request format validation w3c-fedid/digital-credentials#152 (6 comments by @marcoscaceres, @RByers, @samuelgoto, @tlodderstedt)
-
Issuer identity in selective disclosure cases w3c-fedid/digital-credentials#139 (5 comments by @jogu, @martinthomson, @Sakurann)
-
Credential request options mediation requirement w3c-fedid/digital-credentials#147 (4 comments by @marcoscaceres, @Sakurann, @samuelgoto, @timcappalli)
-
Should requests be assumed to be linkable by the browser? w3c-fedid/digital-credentials#122 (3 comments by @ad-Orange, @Sakurann)
-
w3c-fedid/digital-credentials#35 (1 comment by @burdges)
-
w3c-fedid/digital-credentials#44 (1 comment by @jogu)
-
Protocol extensibility: where should we draw the line between what gets parsed and validated by the browser? w3c-fedid/digital-credentials#161 (1 comment by @TomCJones)
-
Consider requiring a strong signal of user intent. w3c-fedid/digital-credentials#134 (1 comment by @samuelgoto)
-
Handling ongoing operations / subsequent call to get() w3c-fedid/digital-credentials#159 (1 comment by @samuelgoto)
-
Threat Modeling for Decentralized Identities w3c-fedid/digital-credentials#115 (1 comment by @simoneonofri)
-
w3c-fedid/digital-credentials#85 (1 comment by @marcoscaceres)
-
w3c-fedid/digital-credentials#23 (1 comment by @Sakurann)
-
Privacy: ensuring RPs blinded to credential existence w3c-fedid/digital-credentials#105 (1 comment by @Sakurann)
-
w3c-fedid/digital-credentials#12 (1 comment by @Sakurann)
-
w3c-fedid/digital-credentials#7 (1 comment by @Sakurann)
-
w3c-fedid/digital-credentials#5 (1 comment by @Sakurann)
-
Should we have a common and interoperable definition of request types and their privacy properties? w3c-fedid/digital-credentials#117 (1 comment by @Sakurann)
-
[spec] add statement about responses with PII MUST be encrypted w3c-fedid/digital-credentials#124 (1 comment by @Sakurann)
-
Most users will experience a no-matching-credential dead-end w3c-fedid/digital-credentials#104 (1 comment by @Sakurann)
-
w3c-fedid/digital-credentials#52 (1 comment by @Sakurann)
-
-
3 pull requests opened.
-
Throw NotSupported for Store w3c-fedid/digital-credentials#158, by @timcappalli.
-
Define registry inclusion rules w3c-fedid/digital-credentials#157, by @marcoscaceres.
-
Add request validation w3c-fedid/digital-credentials#156, by @marcoscaceres.
-
-
5 pull requests merged.
-
Add required mediation w3c-fedid/digital-credentials#149.
-
Add scoping language related to matching and consent. w3c-fedid/digital-credentials#89.
-
Give the data attribute an actual type (object) w3c-fedid/digital-credentials#141.
-
Throw if providers is empty w3c-fedid/digital-credentials#146.
-
Renamed IdentityRequestProvider to DigitalCredentialsProvider w3c-fedid/digital-credentials#71.
-
-
1 pull request closed.
-
Throw NotSupported for Store w3c-fedid/digital-credentials#158.
-
-
13 pull requests received 78 new comments.
-
Define registry inclusion rules w3c-fedid/digital-credentials#157 (20 comments by @bvandersloot-mozilla, @marcoscaceres, @npdoty, @samuelgoto, @TallTed, @timcappalli)
-
Add request validation w3c-fedid/digital-credentials#156 (18 comments by @bc-pi, @marcoscaceres, @OR13, @RByers, @samuelgoto, @TallTed, @timcappalli)
-
Add required mediation w3c-fedid/digital-credentials#149 (17 comments by @bvandersloot-mozilla, @marcoscaceres, @samuelgoto, @TallTed)
-
Throw NotSupported for Store w3c-fedid/digital-credentials#158 (9 comments by @marcoscaceres, @samuelgoto)
-
Use SecurityError for document state check w3c-fedid/digital-credentials#143 (3 comments by @marcoscaceres, @samuelgoto)
-
Give the data attribute an actual type (object) w3c-fedid/digital-credentials#141 (2 comments by @marcoscaceres, @samuelgoto)
-
w3c-fedid/digital-credentials#163 (1 comment by @w3cbot)
-
w3c-fedid/digital-credentials#162 (1 comment by @w3cbot)
-
w3c-fedid/digital-credentials#153 (1 comment by @w3cbot)
-
w3c-fedid/digital-credentials#151 (1 comment by @w3cbot)
-
w3c-fedid/login-status
-
1 issue opened.
-
Add in status indicator extension for Login Status w3c-fedid/login-status#4, by @pascoej.
-
-
1 issue received 1 new comment.
-
Add in status indicator extension for Login Status w3c-fedid/login-status#4 (1 comment by @samuelgoto)
-
Past meetings
Participants
-
5 participants joined.
-
Joseph Heenan (W3C Invited Experts) joined.
-
Paolo De Rosa (W3C Invited Experts) joined.
-
Joel Antoci (Shopify) joined.
-
Nithyananthan Poosamani (Samsung Electronics Co., Ltd.) joined.
-
Bjorn Hjelm (Yubico) joined.
-
-
2 organizations joined.
-
Shopify joined.
-
Samsung Electronics Co., Ltd. joined.
-
GitHub
w3c-fedid/FedCM
-
2 issues opened.
-
Explainer is out of date. Should we remove it? w3c-fedid/FedCM#622, by @samuelgoto.
-
Short IdP cookie lifetimes w3c-fedid/FedCM#621, by @yoavweiss.
-
-
1 issue closed.
-
Short IdP cookie lifetimes w3c-fedid/FedCM#621.
-
-
6 issues received 21 new comments.
-
Short IdP cookie lifetimes w3c-fedid/FedCM#621 (8 comments by @cbiesinger, @johannhof, @samuelgoto, @wparad, @yoavweiss)
-
Why must SameSite=none? w3c-fedid/FedCM#587 (4 comments by @anderspitman, @bvandersloot-mozilla, @cbiesinger)
-
Explainer is out of date. Should we remove it? w3c-fedid/FedCM#622 (3 comments by @aaronpk, @npm1, @samuelgoto)
-
Make it clearer that IdP needs to check Sec-Fetch-Dest w3c-fedid/FedCM#619 (3 comments by @aaronpk, @bc-pi, @samuelgoto)
-
Support chained authentication flows before reducing heuristics and classifications/lists in navigational tracking mitigations w3c-fedid/FedCM#618 (2 comments by @judielaine, @philsmart)
-
w3c-fedid/FedCM#477 (1 comment by @yi-gu)
-
-
1 pull request opened.
-
Add list of FPWD critical issues w3c-fedid/FedCM#623, by @wseltzer.
-
-
6 pull requests received 16 new comments.
-
w3c-fedid/FedCM#547 (1 comment by @npm1)
w3c-fedid/digital-credentials
-
2 issues opened.
-
Credential request options mediation requirement w3c-fedid/digital-credentials#147, by @marcoscaceres.
-
Disallow multiple types via navigator.credentials's methods w3c-fedid/digital-credentials#140, by @marcoscaceres.
-
-
10 issues closed.
-
Add placeholder security and privacy considerations section w3c-fedid/digital-credentials#137.
-
API design should emphasize that sites should request minimal properties, not full identity documents w3c-fedid/digital-credentials#43.
-
Prioritization of credential providers w3c-fedid/digital-credentials#42.
-
Digital credential API should support identity verification w3c-fedid/digital-credentials#127.
-
[Discuss] Limit access to the API based on known allow listed origins w3c-fedid/digital-credentials#59.
-
mutual authentication w3c-fedid/digital-credentials#81.
-
Nothing is learned without consent w3c-fedid/digital-credentials#86.
-
Consume transient activation w3c-fedid/digital-credentials#91.
-
Disallow multiple types via navigator.credentials's methods w3c-fedid/digital-credentials#140.
-
Do we need a permissions policy for third-party frames? w3c-fedid/digital-credentials#78.
-
-
11 issues received 25 new comments.
-
Disallow multiple types via navigator.credentials's methods w3c-fedid/digital-credentials#140 (9 comments by @bvandersloot-mozilla, @marcoscaceres, @samuelgoto)
-
Threat Modeling for Decentralized Identities w3c-fedid/digital-credentials#115 (5 comments by @Sakurann, @simoneonofri)
-
Digital credential API should support identity verification w3c-fedid/digital-credentials#127 (2 comments by @jogu, @timcappalli)
-
w3c-fedid/digital-credentials#43 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#58 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#42 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#59 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#81 (1 comment by @timcappalli)
-
Credential request options mediation requirement w3c-fedid/digital-credentials#147 (1 comment by @marcoscaceres)
-
Issuer identity in selective disclosure cases w3c-fedid/digital-credentials#139 (1 comment by @jogu)
-
-
6 pull requests opened.
-
Add required mediation w3c-fedid/digital-credentials#149, by @marcoscaceres.
-
Add placeholder security and privacy considerations section w3c-fedid/digital-credentials#148, by @timcappalli.
-
Throw if providers is empty w3c-fedid/digital-credentials#146, by @marcoscaceres.
-
Editorial: fixup xrefs w3c-fedid/digital-credentials#145, by @marcoscaceres.
-
Use SecurityError for document state check w3c-fedid/digital-credentials#143, by @marcoscaceres.
-
Give the data attribute an actual type (object) w3c-fedid/digital-credentials#141, by @samuelgoto.
-
-
4 pull requests merged.
-
Add placeholder security and privacy considerations section w3c-fedid/digital-credentials#148.
-
Tweak explainer design goals w3c-fedid/digital-credentials#138.
-
Introduce DiscoverFromExternalSource activation + visibility requirements w3c-fedid/digital-credentials#129.
-
Add Permission Policy w3c-fedid/digital-credentials#132.
-
-
1 pull request closed.
-
Editorial: fixup xrefs w3c-fedid/digital-credentials#145.
-
-
7 pull requests received 31 new comments.
-
Introduce DiscoverFromExternalSource activation + visibility requirements w3c-fedid/digital-credentials#129 (7 comments by @marcoscaceres, @samuelgoto, @TallTed)
-
Give the data attribute an actual type (object) w3c-fedid/digital-credentials#141 (4 comments by @marcoscaceres, @samuelgoto)
-
Add placeholder security and privacy considerations section w3c-fedid/digital-credentials#148 (3 comments by @marcoscaceres, @TallTed)
-
w3c-fedid/digital-credentials#150 (1 comment by @w3cbot)
Past meetings
Participants
-
11 participants joined.
-
Mikkel Christensen (Idura) joined.
-
Mick Hansen (Idura) joined.
-
Niels Flensted-Jensen (Idura) joined.
-
Tobias Wegmann (The German Association for the Digital Economy (BVDW)) joined.
-
Ted Thibodeau Jr (OpenLink Software Inc.) joined.
-
Filip Skokan (Okta) joined.
-
Matthew Miller (Cisco) joined.
-
Pamela Dingle (Microsoft Corporation) joined.
-
Erik Anderson (Microsoft Corporation) joined.
-
Michael Jones (Mattr Limited) joined.
-
Dirk Balfanz (Google LLC) joined.
-
-
5 organizations joined.
-
Idura joined.
-
The German Association for the Digital Economy (BVDW) joined.
-
Cisco joined.
-
Microsoft Corporation joined.
-
OpenLink Software Inc. joined.
-
GitHub
w3c-fedid/digital-credentials
-
17 issues opened.
-
Issuer identity in selective disclosure cases w3c-fedid/digital-credentials#139, by @martinthomson.
-
Add placeholder security and privacy considerations section w3c-fedid/digital-credentials#137, by @RByers.
-
Describe trust signals in protocol registry w3c-fedid/digital-credentials#136, by @npdoty.
-
Explainer: Expand alternatives considered section w3c-fedid/digital-credentials#135, by @RByers.
-
Consider requiring a strong signal of user intent. w3c-fedid/digital-credentials#134, by @mikewest.
-
Consider requiring mitigation of script injection attacks. w3c-fedid/digital-credentials#133, by @mikewest.
-
Define WebDriver integration w3c-fedid/digital-credentials#131, by @RByers.
-
Define error handling w3c-fedid/digital-credentials#130, by @RByers.
-
Digital credential API should support identity verification w3c-fedid/digital-credentials#127, by @pkotwicz2.
-
Digital credential API should support requests for directed identifiers w3c-fedid/digital-credentials#126, by @pkotwicz2.
-
[spec] DigitalCredentialRequestOptions and DigitalCredential objects must be JSON serializable w3c-fedid/digital-credentials#125, by @timcappalli.
-
[spec] add statement about responses with PII MUST be encrypted w3c-fedid/digital-credentials#124, by @timcappalli.
-
Access to an Open Global Web Reduced w3c-fedid/digital-credentials#123, by @bvandersloot-mozilla.
-
Should requests be assumed to be linkable by the browser? w3c-fedid/digital-credentials#122, by @bvandersloot-mozilla.
-
Are iframes supported by the Digital Credential API? w3c-fedid/digital-credentials#120, by @ryanhargrove.
-
What should be the data type for the response? w3c-fedid/digital-credentials#119, by @samuelgoto.
-
Web Platform Tests: refactoring digitial-credentials.tentative.https.html w3c-fedid/digital-credentials#118, by @samuelgoto.
-
-
2 issues closed.
-
Wallet-provided nonce w3c-fedid/digital-credentials#92.
-
Are iframes supported by the Digital Credential API? w3c-fedid/digital-credentials#120.
-
-
25 issues received 68 new comments.
-
Digital credential API should support requests for directed identifiers w3c-fedid/digital-credentials#126 (8 comments by @bc-pi, @dlongley, @dwaite, @samuelgoto, @swcurran, @timcappalli)
-
Threat Modeling for Decentralized Identities w3c-fedid/digital-credentials#115 (7 comments by @bvandersloot-mozilla, @csuwildcat, @simoneonofri, @TomCJones)
-
w3c-fedid/digital-credentials#78 (6 comments by @marcoscaceres, @RByers, @ryanhargrove, @samuelgoto)
-
Consider requiring a strong signal of user intent. w3c-fedid/digital-credentials#134 (5 comments by @bvandersloot-mozilla, @mikewest, @npdoty, @RByers)
-
Should response encryption be required w3c-fedid/digital-credentials#109 (5 comments by @jogu, @martijnharing, @RByers)
-
Should requests be assumed to be linkable by the browser? w3c-fedid/digital-credentials#122 (4 comments by @martinthomson, @npdoty)
-
Consider requiring mitigation of script injection attacks. w3c-fedid/digital-credentials#133 (3 comments by @mikewest, @RByers)
-
Describe trust signals in protocol registry w3c-fedid/digital-credentials#136 (3 comments by @jogu, @npdoty)
-
What should be the data type for the response? w3c-fedid/digital-credentials#119 (3 comments by @marcoscaceres, @samuelgoto)
-
Issuer identity in selective disclosure cases w3c-fedid/digital-credentials#139 (2 comments by @kdenhartog, @martinthomson)
-
Digital credential API should support identity verification w3c-fedid/digital-credentials#127 (2 comments by @jogu, @npdoty)
-
w3c-fedid/digital-credentials#42 (2 comments by @timcappalli)
-
Are iframes supported by the Digital Credential API? w3c-fedid/digital-credentials#120 (2 comments by @marcoscaceres, @timcappalli)
-
Web Platform Tests: refactoring digitial-credentials.tentative.https.html w3c-fedid/digital-credentials#118 (2 comments by @marcoscaceres)
-
Most users will experience a no-matching-credential dead-end w3c-fedid/digital-credentials#104 (1 comment by @npdoty)
-
w3c-fedid/digital-credentials#86 (1 comment by @timcappalli)
-
Should we have a common and interoperable definition of request types and their privacy properties? w3c-fedid/digital-credentials#117 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#92 (1 comment by @tlodderstedt)
-
[spec] add statement about responses with PII MUST be encrypted w3c-fedid/digital-credentials#124 (1 comment by @marcoscaceres)
-
Access to an Open Global Web Reduced w3c-fedid/digital-credentials#123 (1 comment by @bvandersloot-mozilla)
-
w3c-fedid/digital-credentials#35 (1 comment by @bvandersloot-mozilla)
-
Explainer: no mention of what security and privacy properties of a request are desireable w3c-fedid/digital-credentials#108 (1 comment by @marcoscaceres)
-
-
5 pull requests opened.
-
Tweak explainer design goals w3c-fedid/digital-credentials#138, by @RByers.
-
Add Permission Policy w3c-fedid/digital-credentials#132, by @marcoscaceres.
-
Introduce DiscoverFromExternalSource activation + visibility requirements w3c-fedid/digital-credentials#129, by @marcoscaceres.
-
chore: Update PULL_REQUEST_TEMPLATE.md w3c-fedid/digital-credentials#128, by @marcoscaceres.
-
Add store(), create(), type, discovery internals w3c-fedid/digital-credentials#121, by @marcoscaceres.
-
-
3 pull requests merged.
-
Add TAG security and privacy questionnaire w3c-fedid/digital-credentials#111.
-
chore: Update PULL_REQUEST_TEMPLATE.md w3c-fedid/digital-credentials#128.
-
Add store(), create(), type, discovery internals w3c-fedid/digital-credentials#121.
-
-
6 pull requests received 49 new comments.
-
Add TAG security and privacy questionnaire w3c-fedid/digital-credentials#111 (30 comments by @marcoscaceres, @RByers, @TallTed)
-
Introduce DiscoverFromExternalSource activation + visibility requirements w3c-fedid/digital-credentials#129 (8 comments by @marcoscaceres, @samuelgoto)
-
Add store(), create(), type, discovery internals w3c-fedid/digital-credentials#121 (5 comments by @marcoscaceres, @samuelgoto, @TallTed)
-
Add Permission Policy w3c-fedid/digital-credentials#132 (4 comments by @marcoscaceres, @RByers, @samuelgoto)
-
w3c-fedid/FedCM
-
5 issues opened.
-
Make it clearer that IdP needs to check Sec-Fetch-Dest w3c-fedid/FedCM#619, by @npm1.
-
Support signing in with an IdP using a redirection w3c-fedid/FedCM#617, by @embesozzi.
-
In addition to "use", "continue", "signin" and "signup", consider adding "pay" or "checkout" w3c-fedid/FedCM#615, by @samuelgoto.
-
Move the WPTs out of the credential-manager directory w3c-fedid/FedCM#611, by @samuelgoto.
-
-
3 issues closed.
-
The name "token" seem to imply that only ID Tokens can be passed back to RPs w3c-fedid/FedCM#579.
-
FedCM spec: IdP should validate nonce to prevent CSRF? w3c-fedid/FedCM#582.
-
-
14 issues received 25 new comments.
-
infinite `login_url` loop when hints are not met w3c-fedid/FedCM#604 (4 comments by @npm1, @panva, @samuelgoto)
-
Send `Accept-Language` in the HTTP requests w3c-fedid/FedCM#592 (4 comments by @TallTed, @ThisIsMissEm)
-
Make it clearer that IdP needs to check Sec-Fetch-Dest w3c-fedid/FedCM#619 (2 comments by @cbiesinger, @philsmart)
-
Support signing in with an IdP using a redirection w3c-fedid/FedCM#617 (2 comments by @npm1, @panva)
-
Support chained authentication flows before reducing heuristics and classifications/lists in navigational tracking mitigations w3c-fedid/FedCM#618 (1 comment by @bc-pi)
-
The name "token" seem to imply that only ID Tokens can be passed back to RPs w3c-fedid/FedCM#579 (1 comment by @samuelgoto)
-
FedCM spec: IdP should validate nonce to prevent CSRF? w3c-fedid/FedCM#582 (1 comment by @samuelgoto)
-
In `any` mode, make the browser automatically generate `clientId` based on the RP's origin when omitted w3c-fedid/FedCM#586 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#120 (1 comment by @TallTed)
-
IdP Registration API: should the browser reveal to the RP when no IdP has registered before? w3c-fedid/FedCM#605 (1 comment by @npm1)
-
-
1 pull request received 8 new comments.
-
Specify the webdriver command to open terms of service and privacy po… w3c-fedid/FedCM#610 (8 comments by @cbiesinger, @npm1)
-
Participants
-
10 participants joined.
-
Michael Knowles (Google LLC) joined.
-
Ashima Arora (Google LLC) joined.
-
Kaan Icer (Google LLC) joined.
-
Zachary Cancio (Google LLC) joined.
-
Rick Byers (Google LLC) joined.
-
Anthony Nadalin (W3C Invited Experts) joined.
-
Timothy Shamilov (Block, Inc.) joined.
-
Daniel Buchner (Block, Inc.) joined.
-
Phil Smart (W3C Invited Experts) joined.
-
Aaron Parecki (Okta) joined.
-
-
1 organization joined.
-
Block, Inc. joined.
-
GitHub
w3c-fedid/FedCM
-
28 issues opened.
-
Spec says we send SameSite=Strict cookies w3c-fedid/FedCM#609, by @cbiesinger.
-
Error fetching the accounts list from localhost w3c-fedid/FedCM#608, by @samuelgoto.
-
Validate email addresses before displaying them w3c-fedid/FedCM#607, by @samuelgoto.
-
IdP Registration API: should the browser reveal to the RP when no IdP has registered before? w3c-fedid/FedCM#605, by @samuelgoto.
-
infinite `login_url` loop when hints are not met w3c-fedid/FedCM#604, by @panva.
-
is `IdentityCredentialRequestOptionsContext` for FedCM UI only? w3c-fedid/FedCM#603, by @panva.
-
`login_url` lacks a mode hint w3c-fedid/FedCM#602, by @panva.
-
FedCM IdP error responses w3c-fedid/FedCM#601, by @panva.
-
Account picture formats w3c-fedid/FedCM#600, by @obfuscoder.
-
OAuth profile for FedCM w3c-fedid/FedCM#599, by @aaronpk.
-
Client authentication and consent creation w3c-fedid/FedCM#598, by @yaron-zehavi.
-
Bug - FedCM shows only 1st account after login w3c-fedid/FedCM#597, by @yaron-zehavi.
-
FedCM privacy concerns w3c-fedid/FedCM#595, by @anderspitman.
-
Send `Accept-Language` in the HTTP requests w3c-fedid/FedCM#592, by @samuelgoto.
-
Question: why use terms_of_service_url instead of tos_uri? w3c-fedid/FedCM#591, by @ThisIsMissEm.
-
Add `interaction_required` error response w3c-fedid/FedCM#590, by @aaronpk.
-
Reset "Not signed in with the identity provider" w3c-fedid/FedCM#588, by @anderspitman.
-
Why must SameSite=none? w3c-fedid/FedCM#587, by @anderspitman.
-
Add optional `token_endpoint` to IdP config w3c-fedid/FedCM#584, by @aaronpk.
-
FedCM spec: IdP should validate nonce to prevent CSRF? w3c-fedid/FedCM#582, by @obfuscoder.
-
The name "token" seem to imply that only ID Tokens can be passed back to RPs w3c-fedid/FedCM#579, by @samuelgoto.
-
FedSub Domin w3c-fedid/FedCM#577, by @cklim5.
-
DPoP support w3c-fedid/FedCM#572, by @thhck.
-
configURL on different subdomain than other endpoints w3c-fedid/FedCM#571, by @obfuscoder.
-
Is FedCM (currently) compatible with CredMan? w3c-fedid/FedCM#569, by @dolda2000.
-
The invisible UI is kinda weird w3c-fedid/FedCM#568, by @dolda2000.
-
-
46 issues closed.
-
We could use more procedural rigor to coordinate between implementers w3c-fedid/FedCM#431.
-
Scopes and claims request parity in CredentialRequestOptions ? w3c-fedid/FedCM#154.
-
Wallet Selection in CHAPI breaks without 3rd party cookies w3c-fedid/FedCM#374.
-
Relax the number of providers in the .well-known file to 5-10 w3c-fedid/FedCM#333.
-
Clarify and specify the client id's returned as part of the account list w3c-fedid/FedCM#217.
-
What will happen to `SameSite: None` and how should we go about it? w3c-fedid/FedCM#212.
-
FedCM privacy concerns w3c-fedid/FedCM#595.
-
Handling of name in accounts list response. w3c-fedid/FedCM#120.
-
Use of .well-known folder location w3c-fedid/FedCM#160.
-
We should clarify how the RP acquires account id for use in hint field w3c-fedid/FedCM#143.
-
Missing states in state machine 9.1 w3c-fedid/FedCM#249.
-
Clarify the manifest URLs w3c-fedid/FedCM#216.
-
Support different encoding formats for the HTTP endpoints w3c-fedid/FedCM#334.
-
Rename manifest mentions w3c-fedid/FedCM#360.
-
Missing Attack Scenario: IDP and RP owned by the same entity w3c-fedid/FedCM#85.
-
Add brief section for root manifest (near "Manifest" section) w3c-fedid/FedCM#359.
-
Bug - FedCM shows only 1st account after login w3c-fedid/FedCM#597.
-
Question: why use terms_of_service_url instead of tos_uri? w3c-fedid/FedCM#591.
-
Reset "Not signed in with the identity provider" w3c-fedid/FedCM#588.
-
Add optional `token_endpoint` to IdP config w3c-fedid/FedCM#584.
-
Explicitly allow arbitrary request content to the identity assertion endpoint w3c-fedid/FedCM#443.
-
Does user consent to specific data being shared? w3c-fedid/FedCM#129.
-
FedSub Domin w3c-fedid/FedCM#577.
-
Coordination with IsLoggedIn w3c-fedid/FedCM#71.
-
Hide RP's identity from IdP in Authentication w3c-fedid/FedCM#27.
-
Directed e-mail address concerns in case of making it mandatory w3c-fedid/FedCM#24.
-
Decide how to handle signin dialog closure for the IDP signin status API w3c-fedid/FedCM#419.
-
DPoP support w3c-fedid/FedCM#572.
-
getUserInfo returns InvalidStateError when ConfigURL is valid? w3c-fedid/FedCM#554.
-
User cookie should not be sent to the IDP before explicit consent is gathered w3c-fedid/FedCM#231.
-
[VK Company Feedback] OneTap widgets w3c-fedid/FedCM#148.
-
The invisible UI is kinda weird w3c-fedid/FedCM#568.
-
Is FedCM (currently) compatible with CredMan? w3c-fedid/FedCM#569.
-
Directed Basic Profile Optional Fields w3c-fedid/FedCM#72.
-
UI customizations w3c-fedid/FedCM#287.
-
Explicit Sign-in 1.1.2.2 => direct interaction between user and IdP? w3c-fedid/FedCM#245.
-
Mediation oriented API too limited - JWTs w3c-fedid/FedCM#82.
-
Model all assertions exchanged within the APIs as Verifiable Credentials w3c-fedid/FedCM#49.
-
Mediation oriented API too limited - single token response w3c-fedid/FedCM#81.
-
Definition of `unregistered` w3c-fedid/FedCM#127.
-
Account selection, new accounts, and reauth w3c-fedid/FedCM#13.
-
Sharded email at provisioning stage depends on RP w3c-fedid/FedCM#12.
-
-
1 issue reopened.
-
The name "token" seem to imply that only ID Tokens can be passed back to RPs w3c-fedid/FedCM#579, by @samuelgoto.
-
-
69 issues received 254 new comments.
-
Why must SameSite=none? w3c-fedid/FedCM#587 (30 comments by @anderspitman, @annevk, @bc-pi, @bvandersloot-mozilla, @cbiesinger, @johannhof, @samuelgoto, @sebadob)
-
FedCM privacy concerns w3c-fedid/FedCM#595 (20 comments by @aaronpk, @anderspitman, @npm1, @obfuscoder, @samuelgoto, @sebadob)
-
Add `interaction_required` error response w3c-fedid/FedCM#590 (17 comments by @aaronpk, @achimschloss, @npm1, @panva, @philsmart, @samuelgoto, @ThisIsMissEm, @yi-gu)
-
In `any` mode, make the browser automatically generate `clientId` based on the RP's origin when omitted w3c-fedid/FedCM#586 (14 comments by @aaronpk, @cbiesinger, @npm1, @ThisIsMissEm)
-
The name "token" seem to imply that only ID Tokens can be passed back to RPs w3c-fedid/FedCM#579 (12 comments by @aaronpk, @anderspitman, @npm1, @panva, @samuelgoto, @timcappalli)
-
Client authentication and consent creation w3c-fedid/FedCM#598 (12 comments by @aaronpk, @bc-pi, @cbiesinger, @yaron-zehavi)
-
Add "filter" mode to FedCM enabling dynamic OP discovery based on criteria w3c-fedid/FedCM#562 (12 comments by @dwaite, @samuelgoto, @yaron-zehavi)
-
FedCM spec: IdP should validate nonce to prevent CSRF? w3c-fedid/FedCM#582 (10 comments by @aaronpk, @achimschloss, @bc-pi, @cbiesinger, @npm1, @obfuscoder, @samuelgoto)
-
OAuth profile for FedCM w3c-fedid/FedCM#599 (9 comments by @aaronpk, @anderspitman, @bc-pi, @panva, @samuelgoto)
-
The invisible UI is kinda weird w3c-fedid/FedCM#568 (8 comments by @cbiesinger, @dolda2000, @samuelgoto)
-
FedCM IdP error responses w3c-fedid/FedCM#601 (5 comments by @cbiesinger, @npm1, @panva, @samuelgoto)
-
is `IdentityCredentialRequestOptionsContext` for FedCM UI only? w3c-fedid/FedCM#603 (5 comments by @npm1, @panva, @samuelgoto)
-
Bug - FedCM shows only 1st account after login w3c-fedid/FedCM#597 (5 comments by @anderspitman, @yaron-zehavi, @yi-gu)
-
Send `Accept-Language` in the HTTP requests w3c-fedid/FedCM#592 (5 comments by @aaronpk, @samuelgoto, @ThisIsMissEm, @yi-gu)
-
Add optional `token_endpoint` to IdP config w3c-fedid/FedCM#584 (4 comments by @aaronpk, @npm1, @samuelgoto)
-
Reset "Not signed in with the identity provider" w3c-fedid/FedCM#588 (3 comments by @aaronpk, @anderspitman, @npm1)
-
Question: why use terms_of_service_url instead of tos_uri? w3c-fedid/FedCM#591 (2 comments by @samuelgoto, @ThisIsMissEm)
-
configURL on different subdomain than other endpoints w3c-fedid/FedCM#571 (2 comments by @cbiesinger, @obfuscoder)
-
getUserInfo returns InvalidStateError when ConfigURL is valid? w3c-fedid/FedCM#554 (2 comments by @cbiesinger, @sjud)
-
w3c-fedid/FedCM#431 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#154 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#374 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#333 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#217 (1 comment by @yi-gu)
-
IdP Registration API: should the browser reveal to the RP when no IdP has registered before? w3c-fedid/FedCM#605 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#536 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#120 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#160 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#143 (1 comment by @tttzach)
-
w3c-fedid/FedCM#249 (1 comment by @npm1)
-
w3c-fedid/FedCM#216 (1 comment by @npm1)
-
w3c-fedid/FedCM#48 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#334 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#243 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#360 (1 comment by @tttzach)
-
w3c-fedid/FedCM#85 (1 comment by @npm1)
-
w3c-fedid/FedCM#47 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#359 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#241 (1 comment by @anderspitman)
-
w3c-fedid/FedCM#129 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#71 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#27 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#24 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#6 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#419 (1 comment by @tttzach)
-
w3c-fedid/FedCM#231 (1 comment by @tttzach)
-
w3c-fedid/FedCM#148 (1 comment by @tttzach)
-
w3c-fedid/FedCM#72 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#287 (1 comment by @tttzach)
-
w3c-fedid/FedCM#245 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#82 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#49 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#81 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#127 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#13 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#12 (1 comment by @samuelgoto)
-
-
4 pull requests opened.
-
Specify the webdriver command to open terms of service and privacy po… w3c-fedid/FedCM#610, by @cbiesinger.
-
Remove note on IdP to validate nonce (#582) w3c-fedid/FedCM#583, by @obfuscoder.
-
Add sections for the continuation API bundle to the HOWTO w3c-fedid/FedCM#574, by @cbiesinger.
-
Create debug-network-requests-chrome.md w3c-fedid/FedCM#573, by @yi-gu.
-
-
3 pull requests merged.
-
Remove note on IdP to validate nonce (#582) w3c-fedid/FedCM#583.
-
Add sections for the continuation API bundle to the HOWTO w3c-fedid/FedCM#574.
-
Create debug-network-requests-chrome.md w3c-fedid/FedCM#573.
-
-
4 pull requests received 14 new comments.
-
Add sections for the continuation API bundle to the HOWTO w3c-fedid/FedCM#574 (6 comments by @cbiesinger, @samuelgoto)
-
Remove note on IdP to validate nonce (#582) w3c-fedid/FedCM#583 (5 comments by @cbiesinger, @npm1, @obfuscoder, @samuelgoto)
-
w3c-fedid/FedCM#498 (1 comment by @npm1)
-
w3c-fedid/digital-credentials
-
4 issues opened.
-
Should we have a common and interoperable definition of request types and their privacy properties? w3c-fedid/digital-credentials#117, by @samuelgoto.
-
Threat Modeling for Decentralized Identities w3c-fedid/digital-credentials#115, by @simoneonofri.
-
Invoked from disconnected document w3c-fedid/digital-credentials#112, by @RByers.
-
Should response encryption be required w3c-fedid/digital-credentials#109, by @RByers.
-
-
1 issue closed.
-
[Discuss] Requests for multiple credentials w3c-fedid/digital-credentials#39.
-
-
12 issues received 41 new comments.
-
Threat Modeling for Decentralized Identities w3c-fedid/digital-credentials#115 (9 comments by @OR13, @simoneonofri)
-
Invoked from disconnected document w3c-fedid/digital-credentials#112 (7 comments by @bvandersloot-mozilla, @marcoscaceres, @OR13, @samuelgoto)
-
Most users will experience a no-matching-credential dead-end w3c-fedid/digital-credentials#104 (7 comments by @dickhardt, @npdoty, @RByers, @tomvangoethem)
-
Should response encryption be required w3c-fedid/digital-credentials#109 (5 comments by @bc-pi, @msporny, @OR13, @RByers, @samuelgoto)
-
Should we have a common and interoperable definition of request types and their privacy properties? w3c-fedid/digital-credentials#117 (3 comments by @jogu, @samuelgoto, @simoneonofri)
-
w3c-fedid/digital-credentials#85 (1 comment by @OR13)
-
w3c-fedid/digital-credentials#59 (1 comment by @timcappalli)
-
Consider applying the robustness principle with regard to user agent request validation w3c-fedid/digital-credentials#100 (1 comment by @hlflanagan)
-
w3c-fedid/digital-credentials#84 (1 comment by @timcappalli)
-
w3c-fedid/digital-credentials#92 (1 comment by @RByers)
-
w3c-fedid/digital-credentials#91 (1 comment by @RByers)
-
-
5 pull requests opened.
-
Remove bogus latest version link w3c-fedid/digital-credentials#116, by @dontcallmedom.
-
spelling fix w3c-fedid/digital-credentials#114, by @OR13.
-
Add out of scope section w3c-fedid/digital-credentials#113, by @timcappalli.
-
Add TAG security and privacy questionnaire w3c-fedid/digital-credentials#111, by @RByers.
-
Tweak custom-schemes.md w3c-fedid/digital-credentials#110, by @RByers.
-
-
4 pull requests merged.
-
Remove bogus latest version link w3c-fedid/digital-credentials#116.
-
spelling fix w3c-fedid/digital-credentials#114.
-
Add out of scope section w3c-fedid/digital-credentials#113.
-
Tweak custom-schemes.md w3c-fedid/digital-credentials#110.
-
-
4 pull requests received 34 new comments.
-
Add TAG security and privacy questionnaire w3c-fedid/digital-credentials#111 (28 comments by @bc-pi, @dlongley, @msporny, @RByers, @samuelgoto, @TallTed, @timcappalli)
-
Participants
-
1 chair appointed.
-
Wendy Seltzer became a chair.
-
-
1 Team contact appointed.
-
Simone Onofri became a Team contact.
-
-
1 Team contact stepped down.
-
Simone Onofri stepped down as a Team contact.
-
-
20 participants joined.
-
Nakjo Shishkov (Netcetera) joined.
-
Oliver Terbu (Mattr Limited) joined.
-
Tobias Looker (Mattr Limited) joined.
-
Aaron Coburn (Inrupt Inc.) joined.
-
Yi Gu (Google LLC) joined.
-
Zachary Tan (Google LLC) joined.
-
Nicolas Pena Moreno (Google LLC) joined.
-
Kaustubha Govind (Google LLC) joined.
-
Sam Goto (Google LLC) joined.
-
Christian Biesinger (Igalia) joined.
-
Benjamin VanderSloot (Mozilla Foundation) joined.
-
Apoorva Deshpande (Okta) joined.
-
Brian Campbell (Ping Identity) joined.
-
David Waite (Ping Identity) joined.
-
Christopher Harrell (Yubico) joined.
-
Derek Hanson (Yubico) joined.
-
John Bradley (Yubico) joined.
-
Wendy Seltzer (W3C Invited Experts) joined.
-
Anil John (Department of Homeland Security) joined.
-
Ri Xu (Alibaba Group) joined.
-
-
9 organizations joined.
-
Netcetera joined.
-
Mattr Limited joined.
-
Inrupt Inc. joined.
-
Google LLC joined.
-
Mozilla Foundation joined.
-
Ping Identity joined.
-
Yubico joined.
-
Department of Homeland Security joined.
-
Alibaba Group joined.
-
GitHub
w3c-fedid/digital-credentials
-
8 issues opened.
-
Explainer: no mention of what security and privacy properties of a request are desireable w3c-fedid/digital-credentials#108, by @bvandersloot-mozilla.
-
Tradeoffs of being more or less conservative in DC API velocity w3c-fedid/digital-credentials#106, by @RByers.
-
Privacy: ensuring RPs blinded to credential existence w3c-fedid/digital-credentials#105, by @RByers.
-
Most users will experience a no-matching-credential dead-end w3c-fedid/digital-credentials#104, by @dickhardt.
-
Managing request format extensibility without sacrificing security w3c-fedid/digital-credentials#102, by @marcoscaceres.
-
Consider applying the robustness principle with regard to user agent request validation w3c-fedid/digital-credentials#100, by @tplooker.
-
Make sure the origin gets implicitly passed along w3c-fedid/digital-credentials#96, by @marcoscaceres.
-
Add clientData w3c-fedid/digital-credentials#95, by @timcappalli.
-
-
3 issues closed.
-
DigitialCredential's .data should probably be a Uint8Array w3c-fedid/digital-credentials#93.
-
Should `request` be an `object` in addition to a `DOMString`? w3c-fedid/digital-credentials#75.
-
Make sure the origin gets implicitly passed along w3c-fedid/digital-credentials#96.
-
-
7 issues received 19 new comments.
-
Most users will experience a no-matching-credential dead-end w3c-fedid/digital-credentials#104 (3 comments by @dickhardt, @RByers, @timcappalli)
-
Managing request format extensibility without sacrificing security w3c-fedid/digital-credentials#102 (3 comments by @OR13, @RByers, @tplooker)
-
Consider applying the robustness principle with regard to user agent request validation w3c-fedid/digital-credentials#100 (2 comments by @RByers, @tlodderstedt)
-
Make sure the origin gets implicitly passed along w3c-fedid/digital-credentials#96 (2 comments by @marcoscaceres, @timcappalli)
-
Tradeoffs of being more or less conservative in DC API velocity w3c-fedid/digital-credentials#106 (1 comment by @msporny)
-
6 pull requests opened.
-
Change DigitalCredential.data's type to 'any' w3c-fedid/digital-credentials#107, by @marcoscaceres.
-
chore: Update README.md w3c-fedid/digital-credentials#103, by @marcoscaceres.
-
Change DigitalCredential's data to a Uint8Array w3c-fedid/digital-credentials#101, by @marcoscaceres.
-
Add draft explainer w3c-fedid/digital-credentials#99, by @RByers.
-
Add initial explainer w3c-fedid/digital-credentials#98, by @RByers.
-
Use object for request w3c-fedid/digital-credentials#97, by @marcoscaceres.
-
-
5 pull requests merged.
-
Change DigitalCredential.data's type to 'any' w3c-fedid/digital-credentials#107.
-
chore: Update README.md w3c-fedid/digital-credentials#103.
-
Change DigitalCredential's data to a Uint8Array w3c-fedid/digital-credentials#101.
-
Use object for request w3c-fedid/digital-credentials#97.
-
Add draft explainer w3c-fedid/digital-credentials#99.
-
-
1 pull request closed.
-
Add initial explainer w3c-fedid/digital-credentials#98.
-
-
6 pull requests received 41 new comments.
-
Use object for request w3c-fedid/digital-credentials#97 (33 comments by @bvandersloot-mozilla, @c2bo, @jogu, @marcoscaceres, @RByers, @samuelgoto, @tlodderstedt, @tplooker)
-
Change DigitalCredential.data's type to 'any' w3c-fedid/digital-credentials#107 (2 comments by @marcoscaceres, @samuelgoto)
-
Change DigitalCredential's data to a Uint8Array w3c-fedid/digital-credentials#101 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM
-
10 issues opened.
-
FedCM 4 R&E: Organization Chooser / WAYF w3c-fedid/FedCM#566, by @tobiaspc.
-
FedCM 4 R&E: Technical Considerations w3c-fedid/FedCM#565, by @ekupris.
-
FedCM 4 R&E: Filtering IdPs w3c-fedid/FedCM#564, by @tobiaspc.
-
Add "filter" mode to FedCM enabling dynamic OP discovery based on criteria w3c-fedid/FedCM#562, by @yaron-zehavi.
-
Maybe the token format should be specified? w3c-fedid/FedCM#561, by @anderspitman.
-
The Login Status API Set-Login header in a Disconnect Endpoint Response w3c-fedid/FedCM#558, by @vaceksimon.
-
Demo for use of FedCM as an "account picker" in an open banking context w3c-fedid/FedCM#557, by @michielbdejong.
-
getUserInfo returns InvalidStateError when ConfigURL is valid? w3c-fedid/FedCM#554, by @sjud.
-
Allowing IDPs to expose different account lists in different contexts w3c-fedid/FedCM#553, by @cbiesinger.
-
Allow IDPs to use multiple config files within an eTLD+1 w3c-fedid/FedCM#552, by @cbiesinger.
-
-
1 issue closed.
-
Maybe the token format should be specified? w3c-fedid/FedCM#561.
-
-
1 issue reopened.
-
getUserInfo returns InvalidStateError when ConfigURL is valid? w3c-fedid/FedCM#554, by @samuelgoto.
-
-
10 issues received 40 new comments.
-
The Login Status API Set-Login header in a Disconnect Endpoint Response w3c-fedid/FedCM#558 (10 comments by @cbiesinger, @npm1, @samuelgoto, @thomasdarimont, @vaceksimon)
-
w3c-fedid/FedCM#477 (9 comments by @cbiesinger, @elf-pavlik, @jonkoops, @mitar, @samuelgoto, @timcappalli)
-
Maybe the token format should be specified? w3c-fedid/FedCM#561 (6 comments by @anderspitman, @samuelgoto)
-
Add "filter" mode to FedCM enabling dynamic OP discovery based on criteria w3c-fedid/FedCM#562 (4 comments by @philsmart, @samuelgoto, @yaron-zehavi)
-
Demo for use of FedCM as an "account picker" in an open banking context w3c-fedid/FedCM#557 (2 comments by @michielbdejong, @samuelgoto)
-
getUserInfo returns InvalidStateError when ConfigURL is valid? w3c-fedid/FedCM#554 (2 comments by @cbiesinger, @samuelgoto)
-
Allow IDPs to use multiple config files within an eTLD+1 w3c-fedid/FedCM#552 (1 comment by @cbiesinger)
-
Allowing IDPs to expose different account lists in different contexts w3c-fedid/FedCM#553 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#333 (1 comment by @cbiesinger)
-
Lifecycle
-
1 charter started.
-
Chartered until 24 February 2025. Participants had to rejoin under this charter.
-
Participants
-
1 chair appointed.
-
Heather Flanagan became a chair.
-
-
6 participants joined.
-
Brent Zundel (Tradeverifyd) joined.
-
Bas Zoetekouw (SURF bv) joined.
-
Heather Flanagan (Spherical Cow Consulting) joined.
-
Tim Cappalli (Okta) joined.
-
Philippe Le Hegaret (W3C) joined.
-
Nick Doty (Center for Democracy and Technology) joined.
-
-
5 organizations joined.
-
Tradeverifyd joined.
-
SURF bv joined.
-
Spherical Cow Consulting joined.
-
Okta joined.
-
Center for Democracy and Technology joined.
-
GitHub
w3c-fedid/FedCM
-
29 issues closed.
-
WebID should help IdPs and RPs handle multiple identities w3c-fedid/FedCM#46.
-
Offline capabilities w3c-fedid/FedCM#74.
-
Decide on & document error handling for revoke w3c-fedid/FedCM#157.
-
Label numbers mixed up in delegation-oriented model diagram w3c-fedid/FedCM#68.
-
Intriguing and familiar territory about Federated ID w3c-fedid/FedCM#7.
-
Consider adopting OAuth Rich Authorization Request w3c-fedid/FedCM#30.
-
Diagrams are completely invisible in dark mode w3c-fedid/FedCM#274.
-
External revocation after password change or security breach w3c-fedid/FedCM#73.
-
Logout considerations w3c-fedid/FedCM#62.
-
Call for review: the Solid OIDC spec w3c-fedid/FedCM#54.
-
Origin validation w3c-fedid/FedCM#146.
-
Spec should not talk about auto signin w3c-fedid/FedCM#210.
-
What happens during `sign-up` if user rejects? w3c-fedid/FedCM#128.
-
WebID availability outside browsers and its implications w3c-fedid/FedCM#43.
-
Document auto-signin API w3c-fedid/FedCM#172.
-
Specify parameters to the RP logout endpoint. w3c-fedid/FedCM#116.
-
Should FederatedCredentialRequestOptions only accept FederatedIdentityProviders? w3c-fedid/FedCM#117.
-
sign-in flows underspecified w3c-fedid/FedCM#67.
-
`logoutRps` -> `logoutRPs` w3c-fedid/FedCM#224.
-
Example 20 is inconsistent with IDL definitions w3c-fedid/FedCM#138.
-
Enterprise SSO w3c-fedid/FedCM#25.
-
Update WPT to use new name? w3c-fedid/FedCM#103.
-
What happens in `Select an account` algorithm if user doesn't select an account? w3c-fedid/FedCM#125.
-
Update `provider` in FederatedCredential? w3c-fedid/FedCM#118.
-
Can we get data about RP adoption windows to IDP protocol changes? w3c-fedid/FedCM#22.
-
Return value if no account found when calling accounts_endpoint? w3c-fedid/FedCM#124.
-
Request FederatedCredential be removed from Credential Management Level 1 spec? w3c-fedid/FedCM#119.
-
Expand on rationale for modal window w3c-fedid/FedCM#9.
-
-
1 issue reopened.
-
WebID should help IdPs and RPs handle multiple identities w3c-fedid/FedCM#46, by @samuelgoto.
-
-
32 issues received 38 new comments.
-
w3c-fedid/FedCM#117 (2 comments by @cbiesinger)
-
w3c-fedid/FedCM#124 (2 comments by @cbiesinger)
-
w3c-fedid/FedCM#527 (1 comment by @mitar)
-
w3c-fedid/FedCM#74 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#157 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#29 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#68 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#126 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#7 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#434 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#30 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#274 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#73 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#62 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#54 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#146 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#210 (1 comment by @tttzach)
-
w3c-fedid/FedCM#128 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#43 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#172 (1 comment by @tttzach)
-
w3c-fedid/FedCM#116 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#67 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#224 (1 comment by @tttzach)
-
w3c-fedid/FedCM#138 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#25 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#103 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#125 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#118 (1 comment by @cbiesinger)
-
w3c-fedid/FedCM#22 (1 comment by @samuelgoto)
-
w3c-fedid/FedCM#119 (1 comment by @yi-gu)
-
w3c-fedid/FedCM#9 (1 comment by @samuelgoto)