Skip to content

Commit

Permalink
Address comments
Browse files Browse the repository at this point in the history
  • Loading branch information
Pascoe committed Sep 11, 2023
1 parent eb9dd9f commit 65066fa
Showing 1 changed file with 22 additions and 19 deletions.
41 changes: 22 additions & 19 deletions index.bs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1728,12 +1728,12 @@ options, sameOriginWithAncestors)</dfn> [=internal method=] [[!CREDENTIAL-MANAGE
[=[WRP]=] scripts to call {{CredentialsContainer/create()|navigator.credentials.create()}} to request the creation of a new
[=public key credential source=], [=bound credential|bound=] to an [=authenticator=].

By setting <code>|options|.{{CredentialRequestOptions/mediation}}</code> to {{CredentialMediationRequirement/conditional}},
[=[RPS]=] can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> the user has already consented to create a credential via the [=conditionalCreate|conditionalCreate extension=]). [=[RP]=] script SHOULD first check that [conditionalCreate] is present
By setting <code>|options|.{{CredentialCreationOptions/mediation}}</code> to {{CredentialMediationRequirement/conditional}},
[=[RPS]=] can indicate xc that a prominent modal UI should <i>not</i> be shown <i>unless</i> the user has already consented to create a credential via the [=conditionalCreate|conditionalCreate extension=]). [=[RP]=] script SHOULD first check that [conditionalCreate] is present
in {=ClientCapabilities=} in order to avoid the possibility of causing a user-visible error to be returned if the user agent does
not support {{CredentialMediationRequirement/conditional}} [=user mediation=] for {{CredentialsContainer/create()|navigator.credentials.create()}}.

This {{CredentialsContainer/create()|navigator.credentials.create()}} operation can be aborted by leveraging the {{AbortController}};
Any {{CredentialsContainer/create()|navigator.credentials.create()}} operation can be aborted by leveraging the {{AbortController}};
see [[dom#abortcontroller-api-integration]] for detailed instructions.


Expand Down Expand Up @@ -2282,19 +2282,22 @@ When this method is invoked, the user agent MUST execute the following algorithm

1. Let |pkOptions| be the value of <code>|options|.{{CredentialRequestOptions/publicKey}}</code>.

1. If <code>|options|.{{CredentialRequestOptions/mediation}}</code> is present with the value
{{CredentialMediationRequirement/conditional}}:

1. Let |credentialIdFilter| be the value of <code>|pkOptions|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code>.
<li id='GetAssn-DetermineConditional'>
If <code>|options|.{{CredentialRequestOptions/mediation}}</code> is present with the value
{{CredentialMediationRequirement/conditional}}:

1. Let |credentialIdFilter| be the value of <code>|pkOptions|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code>.

1. Set <code>|pkOptions|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code> to [=list/empty=].
1. Set <code>|pkOptions|.{{PublicKeyCredentialRequestOptions/allowCredentials}}</code> to [=list/empty=].

Note: This prevents [=non-discoverable credentials=] from being used during {{CredentialMediationRequirement/conditional}} requests.
Note: This prevents [=non-discoverable credentials=] from being used during {{CredentialMediationRequirement/conditional}} requests.

1. Set a timer |lifetimeTimer| to a value of infinity.
1. Set a timer |lifetimeTimer| to a value of infinity.

Note: |lifetimeTimer| is set to a value of infinity so that the user has the entire lifetime of
the [=Document=] to interact with any <{input}> form control tagged with a `"webauthn"` [=autofill detail token=]. For example, upon the user clicking in such an input field, the user agent can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to "try another way".
Note: |lifetimeTimer| is set to a value of infinity so that the user has the entire lifetime of
the [=Document=] to interact with any <{input}> form control tagged with a `"webauthn"` [=autofill detail token=]. For example, upon the user clicking in such an input field, the user agent can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to "try another way".
</li>

1. Else:

Expand Down Expand Up @@ -6732,7 +6735,7 @@ During a transition from the FIDO U2F JavaScript API, a [=[RP]=] may have a popu

### Conditional Create Extension (<dfn>conditionalCreate</dfn>) ### {#sctn-authenticator-conditional-create-extension}

This [=client extension|client=] [=authentication extension=] indicates that the RP would like to create a credential after an authenticaton ceremony is successfully mediated by the user agent.
This [=client extension|client=] [=authentication extension=] indicates that the [=[RP]=] would like to create a credential after an authentication ceremony is successfully mediated by the user agent.


: Extension identifier
Expand All @@ -6752,26 +6755,26 @@ This [=client extension|client=] [=authentication extension=] indicates that the
: Client extension processing

:: When [[#sctn-getAssertion|assertion]]:
1. Just after [establishing the RP ID](#GetAssertion-DetermineConditional) perform these steps:
1. Just after [establishing the RP ID](#GetAssn-DetermineConditional) perform these steps:

1. If <code>|options|.{{CredentialRequestOptions/mediation}}</code> is not present or does not have the value
{{CredentialMediationRequirement/conditional}}:

1. Throw a "{{NotAllowedError}}" {{DOMException}}

1. When [showing conditional assertion form control](GetAssn-ConditionalMediation-Interact-FormControl):
1. When [showing conditional assertion form control](#GetAssn-ConditionalMediation-Interact-FormControl):

1. Inform the user that the RP will create a credential if the user agent mediates the authentication ceremony.
1. Inform the user that the [=[RP]=] will create a credential if the user agent mediates the authentication ceremony.

1. Set conditionalCreateLifetimeTimer to a client-specific default.
1. Set |conditionalCreateLifetimeTimer| to a client-specific default.

1. Set conditionalCreateOrigin to the current origin.
1. Set |conditionalCreateOrigin| to the current origin.

1. If the user agent mediates the authentication ceremony while the conditional assertion is running:

1. Start conditionalCreateLifetimeTimer.
1. Start |conditionalCreateLifetimeTimer|.

1. Optionally collect an [=authorization gesture=] confirming [=user consent=] to create the credential which may later be used to skip (this step)[#op-makecred-step-user-consent] when processing an associated {{CredentialsContainer/get()|navigator.credentials.get()}} call with <code>|options|.{{CredentialRequestOptions/mediation}}</code> set to {{CredentialMediationRequirement/conditional}}.
1. Optionally collect an [=authorization gesture=] confirming [=user consent=] to create the credential which may later be used to skip (this step)[#op-makecred-step-user-consent].

: Client extension output
:: None
Expand Down

0 comments on commit 65066fa

Please sign in to comment.