-
Notifications
You must be signed in to change notification settings - Fork 43
JSON (De)serialization Methods TAG security & privacy questionnaire
TAG review requires filling a Security and Privacy questionnaire.
-
What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?
These methods take data that are already being returned as part of the WebAuthn response and serializing or deserializing it into the JSON format. As a result, these methods do not expose any information, it modifies existing data provided by the origin and data that requires user consent to receive.
-
Do features in your specification expose the minimum amount of information necessary to enable their intended uses?
No additional information is exposed by these methods, this is primarily a utility to marshal existing data into a preferred format for web developers.
-
How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?
For Credential Management in general, see the Security and Privacy considerations. Serialization of the credential options and responses does not change handling of PII.
-
How do the features in your specification deal with sensitive information?
Handling of PII is not changed, see 3 for how security and privacy is handled for Credential Management in general
-
Do the features in your specification introduce new state for an origin that persists across browsing sessions?
No
-
Do the features in your specification expose information about the underlying platform to origins?
No
-
Does this specification allow an origin to send data to the underlying platform?
No
-
Do features in this specification enable access to device sensors?
No
-
What data do the features in this specification expose to an origin? Please also document what data is identical to data exposed by other features, in the same or different contexts.
This feature takes credential request options provided by an origin and credential responses that the user has consented to release to an origin and allows the data to be transformed wholly into JSON or from JSON. The data exposed is entirely identical to the data that already is given and received in a WebAuthn ceremony.
-
Do features in this specification enable new script execution/loading mechanisms?
No
-
Do features in this specification allow an origin to access other devices?
No
-
Do features in this specification allow an origin some measure of control over a user agent’s native UI?
This does not effect the user agent's UI, as it is primarily a method to parse data for processing by the origin.
-
What temporary identifiers do the features in this specification create or expose to the web?
The serialization methods do not introduce new identifiers.
-
How does this specification distinguish between behavior in first-party and third-party contexts?
The serialization methods do not change how Credential Management is handled for first-party vs third-party contexts.
For a general discussion on credential management, see Cross domain credential access and Origin confusion.
-
How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?
Incognito or Private Browsing modes are not impacted by this method.
-
Does this specification have both "Security Considerations" and "Privacy Considerations" sections?
https://w3c.github.io/webappsec-credential-management/#security-and-privacy
-
Do features in your specification enable origins to downgrade default security protections?
No
-
How does your feature handle non-"fully active" documents?
In practice, a
navigator.credentials.get()request will pause with the promise remaining unresolved, and may be resumed if the document becomes fully active again, however this is not impacted by or an impact to the method we're introducing.