From 537736625ed6bd7cbae7c968fa0fe5edf4adf2c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Anders=20=C3=85berg?= Date: Wed, 21 Feb 2024 18:55:54 +0100 Subject: [PATCH] Update index.bs --- index.bs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.bs b/index.bs index a91e3bbe2..e66824fec 100644 --- a/index.bs +++ b/index.bs @@ -1344,7 +1344,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S - The [=determines the set of origins on which the public key credential may be exercised|origin=]'s [=scheme=] must be `https`. - The [=determines the set of origins on which the public key credential may be exercised|origin=]'s [=port=] is unrestricted. - For example, given a [=[RP]=] whose origin is `https://login.example.com:1337`, then the following [=RP ID=]s are valid: `login.example.com` (default) and `example.com`, but not `m.login.example.com` and not `com`. Another example of a valid origin is `http://localhost:8000`, due to being considered a [=secure context=]. + For example, given a [=[RP]=] whose origin is `https://login.example.com:1337`, then the following [=RP ID=]s are valid: `login.example.com` (default) and `example.com`, but not `m.login.example.com` and not `com`. Another example of a valid origin is `http://localhost:8000`, due to the origin being `localhost` This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, [[RFC6265]]). Please note that this is a greater relaxation of "same-origin" restrictions than what