From a0a8d192358b81dcc1b3ddb324e491b90e814095 Mon Sep 17 00:00:00 2001
From: Anthony Nadalin <tonynad@microsoft.com>
Date: Thu, 12 Sep 2024 02:43:54 +0000
Subject: [PATCH] Merge pull request #2104 from zacknewman/zacknewman-patch-1

SHA: 403c2b3380a976ed162fc6833b3ee124adfc0e4f
Reason: push, by nadalin

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 65 ++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 41 insertions(+), 24 deletions(-)

diff --git a/index.html b/index.html
index 13960659a..d8a1aa632 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 6270e4735, updated Tue Aug 6 12:12:30 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="fb6351bd6cccce319531dc3638f3008738a16ac1" name="revision">
+  <meta content="403c2b3380a976ed162fc6833b3ee124adfc0e4f" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-09-11">11 September 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-09-12">12 September 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -4752,7 +4752,12 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
       <li data-md>
        <p>A string, <var>origin</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑤">origin</a></code> that issued the request to the user agent.</p>
       <li data-md>
-       <p>A boolean, <var>crossOrigin</var>, that is true if, and only if, the request should have been performed within a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element">iframe</a></code>.</p>
+       <p>An optional string, <var>topOrigin</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑥">topOrigin</a></code> that issued the request to the user agent, if available.</p>
+      <li data-md>
+       <p>A boolean, <var>requireTopOrigin</var>, that is true if, and only if, the verification should fail
+if <var>topOrigin</var> is defined and the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code> attribute is not present in <var>clientDataJSON</var>.</p>
+       <p>This means that the verification algorithm is backwards compatible
+with the <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#clientdatajson-serialization">JSON-compatible serialization algorithm</a> in Web Authentication Level 2 <a data-link-type="biblio" href="#biblio-webauthn-2-20210408" title="Web Authentication: An API for accessing Public Key Credentials - Level 2">[webauthn-2-20210408]</a> if, and only if, <var>requireTopOrigin</var> is <code>false</code>.</p>
      </ol>
     <li data-md>
      <p>Let <var>expected</var> be an empty byte string.</p>
@@ -4773,13 +4778,23 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
     <li data-md>
      <p>Append 0x2c2263726f73734f726967696e223a (<code>,"crossOrigin":</code>) to <var>expected</var>.</p>
     <li data-md>
-     <p>If <var>crossOrigin</var> is true:</p>
+     <p>If <var>topOrigin</var> is defined:</p>
      <ol>
       <li data-md>
        <p>Append 0x74727565 (<code>true</code>) to <var>expected</var>.</p>
+      <li data-md>
+       <p>If <var>requireTopOrigin</var> is true
+or if 0x2c22746f704f726967696e223a (<code>,"topOrigin":</code>) is a prefix
+of the substring of <var>clientDataJSON</var> beginning at the offset equal to the length of <var>expected</var>:</p>
+       <ol>
+        <li data-md>
+         <p>Append 0x2c22746f704f726967696e223a (<code>,"topOrigin":</code>) to <var>expected</var>.</p>
+        <li data-md>
+         <p>Append <a data-link-type="dfn" href="#ccdtostring" id="ref-for-ccdtostring⑦">CCDToString</a>(<var>topOrigin</var>) to <var>expected</var>.</p>
+       </ol>
      </ol>
     <li data-md>
-     <p>Otherwise, i.e. <var>crossOrigin</var> is false:</p>
+     <p>Otherwise, i.e. <var>topOrigin</var> is not defined:</p>
      <ol>
       <li data-md>
        <p>Append 0x66616c7365 (<code>false</code>) to <var>expected</var>.</p>
@@ -4803,7 +4818,7 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
      </dl>
    </ol>
    <h5 class="heading settled" data-level="5.8.1.3" id="clientdatajson-development"><span class="secno">5.8.1.3. </span><span class="content">Future development</span><a class="self-link" href="#clientdatajson-development"></a></h5>
-   <p>In order to remain compatible with the <a href="#clientdatajson-verification">limited verification algorithm</a>, future versions of this specification must not remove any of the fields <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑥">type</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑤">challenge</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑥">origin</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑥">crossOrigin</a></code>, or <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑥">topOrigin</a></code> from <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①①">CollectedClientData</a></code>. They also must not change the <a href="#clientdatajson-verification">serialization algorithm</a> to change the order in which those fields are serialized, or insert new fields between them.</p>
+   <p>In order to remain compatible with the <a href="#clientdatajson-verification">limited verification algorithm</a>, future versions of this specification must not remove any of the fields <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑥">type</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑤">challenge</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑥">origin</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin⑥">crossOrigin</a></code>, or <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code> from <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①①">CollectedClientData</a></code>. They also must not change the <a href="#clientdatajson-verification">serialization algorithm</a> to change the order in which those fields are serialized, or insert new fields between them.</p>
    <p>If additional fields are added to <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①②">CollectedClientData</a></code> then verifiers that employ the <a href="#clientdatajson-verification">limited verification algorithm</a> will not be able to consider them until the two algorithms above are updated to include them. Once such an update occurs then the added fields inherit the same limitations as described in the previous paragraph. Such an algorithm update would have to accomodate serializations produced by previous versions. I.e. the verification algorithm would have to handle the fact that a sixth key–value pair may not appear sixth (or at all) if generated by a user agent working from a previous version.</p>
    <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span class="secno">5.8.2. </span><span class="content">Credential Type Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-publickeycredentialtype"><code>PublicKeyCredentialType</code></dfn>)</span><a class="self-link" href="#enum-credentialType"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑤"><c- g>PublicKeyCredentialType</c-></a> {
@@ -5020,8 +5035,8 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
    <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②⓪">internal methods</a> does not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel⑤">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer④">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential" id="ref-for-abstract-opdef-create-a-credential">Create a <code>Credential</code></a> and <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operations <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
-   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
-To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
+   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element">iframe</a></code>s.
+To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span class="secno">5.11. </span><span class="content">Using Web Authentication across related origins</span><a class="self-link" href="#sctn-related-origins"></a></h3>
    <p>By default, Web Authentication requires that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> be equal to the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⑨">effective domain</a>, or a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to⑤">registrable domain suffix</a> of the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain②⓪">effective domain</a>.</p>
@@ -6262,13 +6277,13 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li id="rp-op-registering-a-new-credential-step-origin"><a class="self-link" href="#rp-op-registering-a-new-credential-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
-     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
        <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
 that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
@@ -6437,12 +6452,12 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> is an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a>.
   See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance. 
     <li data-md>
-     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
+     <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
        <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
-       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
+       <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
 that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> expects to be sub-framed within.
 See <a href="#sctn-validating-origin">§ 13.4.9 Validating the origin of a credential</a> for guidance.</p>
      </ol>
@@ -8620,7 +8635,7 @@ <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span clas
    </ol>
    <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
    <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
@@ -8743,21 +8758,21 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
      <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> to be an operating system dependent
 identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②⓪">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
-   <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> MUST validate that its value is expected.
+   <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①③">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> MUST validate that its value is expected.
 This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
-     <p>A web application that does not wish to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑤">iframe</a></code> might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①③">topOrigin</a></code> to exactly equal <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②①">origin</a></code>.</p>
+     <p>A web application that does not wish to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code> might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑤">topOrigin</a></code> to exactly equal <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②①">origin</a></code>.</p>
     <li data-md>
-     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑥">iframe</a></code> on a small number of domains
-might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①④">topOrigin</a></code> to exactly equal some element of a list of allowed origins,
+     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑤">iframe</a></code> on a small number of domains
+might require <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑥">topOrigin</a></code> to exactly equal some element of a list of allowed origins,
 for example the list <code>["https://example-partner1.org", "https://login.partner2-example.org"]</code>.</p>
     <li data-md>
-     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑦">iframe</a></code> on a large number of domains
-might allow any value of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑤">topOrigin</a></code>, or use a dynamic procedure
-to determine whether a given <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑥">topOrigin</a></code> value is allowed for a particular ceremony.</p>
+     <p>A web application that wishes to be embedded in a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element⑥">iframe</a></code> on a large number of domains
+might allow any value of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑦">topOrigin</a></code>, or use a dynamic procedure
+to determine whether a given <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⑧">topOrigin</a></code> value is allowed for a particular ceremony.</p>
    </ul>
    <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><span class="secno">14. </span><span class="content">Privacy Considerations</span><a class="self-link" href="#sctn-privacy-considerations"></a></h2>
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
@@ -10172,6 +10187,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>Anne van Kesteren. <a href="https://url.spec.whatwg.org/"><cite>URL Standard</cite></a>. Living Standard. URL: <a href="https://url.spec.whatwg.org/">https://url.spec.whatwg.org/</a>
    <dt id="biblio-wcag21">[WCAG21]
    <dd>Michael Cooper; et al. <a href="https://w3c.github.io/wcag/guidelines/22/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/guidelines/22/">https://w3c.github.io/wcag/guidelines/22/</a>
+   <dt id="biblio-webauthn-2-20210408">[WEBAUTHN-2-20210408]
+   <dd>Jeff Hodges; et al. <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/"><cite>Web Authentication: An API for accessing Public Key Credentials - Level 2</cite></a>. URL: <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/">https://www.w3.org/TR/2021/REC-webauthn-2-20210408/</a>
    <dt id="biblio-webdriver">[WebDriver]
    <dd>Simon Stewart; David Burns. <a href="https://w3c.github.io/webdriver/"><cite>WebDriver</cite></a>. URL: <a href="https://w3c.github.io/webdriver/">https://w3c.github.io/webdriver/</a>
    <dt id="biblio-webidl">[WebIDL]
@@ -11162,7 +11179,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "85394472": {"dfnID":"85394472","dfnText":"Document","external":true,"refSections":[{"refs":[{"id":"ref-for-document"}],"title":"5.9. Permissions Policy integration"}],"url":"https://dom.spec.whatwg.org/#document"},
 "87478abb": {"dfnID":"87478abb","dfnText":"document.domain","external":true,"refSections":[{"refs":[{"id":"ref-for-dom-document-domain"}],"title":"4. Terminology"}],"url":"https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain"},
 "87d65d53": {"dfnID":"87d65d53","dfnText":"section 7","external":true,"refSections":[{"refs":[{"id":"ref-for-section-7"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-section-7\u2460"}],"title":"6.5.1. Attested Credential Data"},{"refs":[{"id":"ref-for-section-7\u2461"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-section-7\u2462"}],"title":"8.6. FIDO U2F Attestation Statement Format"}],"url":"https://tools.ietf.org/html/rfc9052#section-7"},
-"87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"},{"id":"ref-for-the-iframe-element\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"},{"id":"ref-for-the-iframe-element\u2466"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
+"87fcd40c": {"dfnID":"87fcd40c","dfnText":"iframe","external":true,"refSections":[{"refs":[{"id":"ref-for-the-iframe-element"},{"id":"ref-for-the-iframe-element\u2460"},{"id":"ref-for-the-iframe-element\u2461"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-the-iframe-element\u2462"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-the-iframe-element\u2463"},{"id":"ref-for-the-iframe-element\u2464"},{"id":"ref-for-the-iframe-element\u2465"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element"},
 "8841d736": {"dfnID":"8841d736","dfnText":"internal method","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2466"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2467"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2468"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2460"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2461"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2462"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2463"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2464"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2465"},{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2466"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2467"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2460\u2468"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-sec-object-internal-methods-and-internal-slots\u2461\u24ea"}],"title":"5.9. Permissions Policy integration"}],"url":"https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots"},
 "8855a9aa": {"dfnID":"8855a9aa","dfnText":"DOMString","external":true,"refSections":[{"refs":[{"id":"ref-for-idl-DOMString"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-idl-DOMString\u2460"},{"id":"ref-for-idl-DOMString\u2461"},{"id":"ref-for-idl-DOMString\u2462"},{"id":"ref-for-idl-DOMString\u2463"},{"id":"ref-for-idl-DOMString\u2464"},{"id":"ref-for-idl-DOMString\u2465"},{"id":"ref-for-idl-DOMString\u2466"},{"id":"ref-for-idl-DOMString\u2467"},{"id":"ref-for-idl-DOMString\u2468"},{"id":"ref-for-idl-DOMString\u2460\u24ea"},{"id":"ref-for-idl-DOMString\u2460\u2460"},{"id":"ref-for-idl-DOMString\u2460\u2461"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2463"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2460\u2464"},{"id":"ref-for-idl-DOMString\u2460\u2465"},{"id":"ref-for-idl-DOMString\u2460\u2466"},{"id":"ref-for-idl-DOMString\u2460\u2467"},{"id":"ref-for-idl-DOMString\u2460\u2468"},{"id":"ref-for-idl-DOMString\u2461\u24ea"},{"id":"ref-for-idl-DOMString\u2461\u2460"},{"id":"ref-for-idl-DOMString\u2461\u2461"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2462"},{"id":"ref-for-idl-DOMString\u2461\u2463"},{"id":"ref-for-idl-DOMString\u2461\u2464"},{"id":"ref-for-idl-DOMString\u2461\u2465"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2461\u2466"},{"id":"ref-for-idl-DOMString\u2461\u2467"},{"id":"ref-for-idl-DOMString\u2461\u2468"},{"id":"ref-for-idl-DOMString\u2462\u24ea"},{"id":"ref-for-idl-DOMString\u2462\u2460"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2461"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2462"},{"id":"ref-for-idl-DOMString\u2462\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2464"},{"id":"ref-for-idl-DOMString\u2462\u2465"}],"title":"5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"},{"refs":[{"id":"ref-for-idl-DOMString\u2462\u2466"},{"id":"ref-for-idl-DOMString\u2462\u2467"},{"id":"ref-for-idl-DOMString\u2462\u2468"},{"id":"ref-for-idl-DOMString\u2463\u24ea"},{"id":"ref-for-idl-DOMString\u2463\u2460"},{"id":"ref-for-idl-DOMString\u2463\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2462"},{"id":"ref-for-idl-DOMString\u2463\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2464"},{"id":"ref-for-idl-DOMString\u2463\u2465"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2466"},{"id":"ref-for-idl-DOMString\u2463\u2467"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-idl-DOMString\u2463\u2468"},{"id":"ref-for-idl-DOMString\u2464\u24ea"},{"id":"ref-for-idl-DOMString\u2464\u2460"},{"id":"ref-for-idl-DOMString\u2464\u2461"},{"id":"ref-for-idl-DOMString\u2464\u2462"},{"id":"ref-for-idl-DOMString\u2464\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-idl-DOMString\u2464\u2464"},{"id":"ref-for-idl-DOMString\u2464\u2465"},{"id":"ref-for-idl-DOMString\u2464\u2466"},{"id":"ref-for-idl-DOMString\u2464\u2467"},{"id":"ref-for-idl-DOMString\u2464\u2468"},{"id":"ref-for-idl-DOMString\u2465\u24ea"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-idl-DOMString\u2465\u2460"},{"id":"ref-for-idl-DOMString\u2465\u2461"},{"id":"ref-for-idl-DOMString\u2465\u2462"},{"id":"ref-for-idl-DOMString\u2465\u2463"},{"id":"ref-for-idl-DOMString\u2465\u2464"},{"id":"ref-for-idl-DOMString\u2465\u2465"},{"id":"ref-for-idl-DOMString\u2465\u2466"},{"id":"ref-for-idl-DOMString\u2465\u2467"},{"id":"ref-for-idl-DOMString\u2465\u2468"},{"id":"ref-for-idl-DOMString\u2466\u24ea"},{"id":"ref-for-idl-DOMString\u2466\u2460"},{"id":"ref-for-idl-DOMString\u2466\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2462"},{"id":"ref-for-idl-DOMString\u2466\u2463"},{"id":"ref-for-idl-DOMString\u2466\u2464"},{"id":"ref-for-idl-DOMString\u2466\u2465"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2466"},{"id":"ref-for-idl-DOMString\u2466\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-idl-DOMString\u2466\u2468"},{"id":"ref-for-idl-DOMString\u2467\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"https://webidl.spec.whatwg.org/#idl-DOMString"},
 "889e932f": {"dfnID":"889e932f","dfnText":"Exposed","external":true,"refSections":[{"refs":[{"id":"ref-for-Exposed"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-Exposed\u2460"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-Exposed\u2461"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-Exposed\u2462"}],"title":"5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}],"url":"https://webidl.spec.whatwg.org/#Exposed"},
@@ -11335,7 +11352,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "cbor": {"dfnID":"cbor","dfnText":"CBOR","external":false,"refSections":[{"refs":[{"id":"ref-for-cbor"}],"title":"2.4. All Conformance Classes"},{"refs":[{"id":"ref-for-cbor\u2460"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-cbor\u2461"},{"id":"ref-for-cbor\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-cbor\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-cbor\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-cbor\u2465"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-cbor\u2466"},{"id":"ref-for-cbor\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-cbor\u2468"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u24ea"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-cbor\u2460\u2460"},{"id":"ref-for-cbor\u2460\u2461"},{"id":"ref-for-cbor\u2460\u2462"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2463"},{"id":"ref-for-cbor\u2460\u2464"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-cbor\u2460\u2465"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-cbor\u2460\u2466"},{"id":"ref-for-cbor\u2460\u2467"}],"title":"9.4. Client Extension Processing"},{"refs":[{"id":"ref-for-cbor\u2460\u2468"},{"id":"ref-for-cbor\u2461\u24ea"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#cbor"},
 "cc890cc1": {"dfnID":"cc890cc1","dfnText":"policy-controlled feature","external":true,"refSections":[{"refs":[{"id":"ref-for-policy-controlled-feature"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature"},
 "cca3cdb2": {"dfnID":"cca3cdb2","dfnText":"AbortSignal","external":true,"refSections":[{"refs":[{"id":"ref-for-abortsignal"}],"title":"5.6. Abort Operations with AbortSignal"}],"url":"https://dom.spec.whatwg.org/#abortsignal"},
-"ccdtostring": {"dfnID":"ccdtostring","dfnText":"CCDToString","external":false,"refSections":[{"refs":[{"id":"ref-for-ccdtostring"},{"id":"ref-for-ccdtostring\u2460"},{"id":"ref-for-ccdtostring\u2461"},{"id":"ref-for-ccdtostring\u2462"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-ccdtostring\u2463"},{"id":"ref-for-ccdtostring\u2464"},{"id":"ref-for-ccdtostring\u2465"}],"title":"5.8.1.2. Limited Verification Algorithm"}],"url":"#ccdtostring"},
+"ccdtostring": {"dfnID":"ccdtostring","dfnText":"CCDToString","external":false,"refSections":[{"refs":[{"id":"ref-for-ccdtostring"},{"id":"ref-for-ccdtostring\u2460"},{"id":"ref-for-ccdtostring\u2461"},{"id":"ref-for-ccdtostring\u2462"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-ccdtostring\u2463"},{"id":"ref-for-ccdtostring\u2464"},{"id":"ref-for-ccdtostring\u2465"},{"id":"ref-for-ccdtostring\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"}],"url":"#ccdtostring"},
 "cce1676e": {"dfnID":"cce1676e","dfnText":"extension command","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-extension-commands"}],"title":"11. User Agent Automation"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2460"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2462"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2463"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2464"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2465"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2466"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2467"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2468"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-extension-commands\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-extension-commands"},
 "cddl": {"dfnID":"cddl","dfnText":"CDDL","external":false,"refSections":[{"refs":[{"id":"ref-for-cddl"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-cddl\u2460"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-cddl\u2461"}],"title":"9.3. Extending Request Parameters"}],"url":"#cddl"},
 "cece9985": {"dfnID":"cece9985","dfnText":"kty","external":true,"refSections":[{"refs":[{"id":"ref-for-name-cose-key-common-parameters"}],"title":"5.2.1.1. Easily accessing credential data"}],"url":"https://tools.ietf.org/html/rfc9052#name-cose-key-common-parameters"},
@@ -11514,7 +11531,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-collectedclientdata-crossorigin": {"dfnID":"dom-collectedclientdata-crossorigin","dfnText":"crossOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2461"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2462"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2463"},{"id":"ref-for-dom-collectedclientdata-crossorigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-crossorigin\u2465"}],"title":"5.8.1.3. Future development"}],"url":"#dom-collectedclientdata-crossorigin"},
 "dom-collectedclientdata-origin": {"dfnID":"dom-collectedclientdata-origin","dfnText":"origin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-origin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u24ea"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2460"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2461"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2467"},{"id":"ref-for-dom-collectedclientdata-origin\u2460\u2468"},{"id":"ref-for-dom-collectedclientdata-origin\u2461\u24ea"},{"id":"ref-for-dom-collectedclientdata-origin\u2461\u2460"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-origin"},
 "dom-collectedclientdata-tokenbinding": {"dfnID":"dom-collectedclientdata-tokenbinding","dfnText":"tokenBinding","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-tokenbinding"},{"id":"ref-for-dom-collectedclientdata-tokenbinding\u2460"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}],"url":"#dom-collectedclientdata-tokenbinding"},
-"dom-collectedclientdata-toporigin": {"dfnID":"dom-collectedclientdata-toporigin","dfnText":"topOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2466"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2468"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2460"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2461"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2465"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-toporigin"},
+"dom-collectedclientdata-toporigin": {"dfnID":"dom-collectedclientdata-toporigin","dfnText":"topOrigin","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2464"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2466"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2467"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2468"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2460"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2462"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2463"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2464"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2465"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2466"},{"id":"ref-for-dom-collectedclientdata-toporigin\u2460\u2467"}],"title":"13.4.9. Validating the origin of a credential"}],"url":"#dom-collectedclientdata-toporigin"},
 "dom-collectedclientdata-type": {"dfnID":"dom-collectedclientdata-type","dfnText":"type","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-collectedclientdata-type"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2461"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2462"},{"id":"ref-for-dom-collectedclientdata-type\u2463"}],"title":"5.8.1.1. Serialization"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2464"}],"title":"5.8.1.2. Limited Verification Algorithm"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2465"}],"title":"5.8.1.3. Future development"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-collectedclientdata-type\u2467"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-collectedclientdata-type"},
 "dom-credentialcreationoptions-publickey": {"dfnID":"dom-credentialcreationoptions-publickey","dfnText":"publicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2460"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2461"},{"id":"ref-for-dom-credentialcreationoptions-publickey\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-dom-credentialcreationoptions-publickey\u2464"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#dom-credentialcreationoptions-publickey"},
 "dom-credentialpropertiesoutput-authenticatordisplayname": {"dfnID":"dom-credentialpropertiesoutput-authenticatordisplayname","dfnText":"authenticatorDisplayName","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2460"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2461"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2462"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2463"},{"id":"ref-for-dom-credentialpropertiesoutput-authenticatordisplayname\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#dom-credentialpropertiesoutput-authenticatordisplayname"},