November 2021 - webkit-dev - lists.webkit.org

Request for position: WebAuthn minPinLength
by Adam Langley 20 Nov '21

20 Nov '21

Dear WebKit, As part of the Blink process we're seeking any input that WebKit may have on the minPinLength extension in WebAuthn. What follows is the explainer <https://github.com/w3c/webauthn/wiki/Explainer:-minPinLength> for this change: Security keys are physical devices, often USB-connected, that can create public–private key pairs and sign with the private keys to authenticate a user. Websites can use them via the WebAuthn API <https://www.w3.org/TR/webauthn-2/>. Several major sites allow users to register security keys for better account security, for example, Microsoft, Dropbox, GitHub, Google, and Facebook, to name a few. Expert / high-sensitivity accounts are one user cohort, but security keys are also used by enterprises and governments. In the latter contexts, they can form part of a compliance system, for example for both public and private sectors SP800-63-3 <https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret> requires user-selected memorized secrets (e.g. PINs) be a minimum of 8 characters. In order to meet SP800-63-3, enterprises can use the user verification <https://www.w3.org/TR/webauthn-2/#user-verification> feature of WebAuthn, which involves local entry of a PIN or use of a fingerprint reader on the security key. However, such compliance regimes often have requirements for minimum PIN lengths greater than the default minimum <https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authent…> of 4 characters. In order to help organizations with meeting such regulatory requirements, the current standard for security keys (CTAP 2.1 <https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authent…>) defines an extension called minPinLength <https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authent…>. This allows the authenticator to report, when a credential is created, the authenticator's current configured minimum PIN length. Since the minimum can only be decreased by resetting the security key, which erases all credentials, an enterprise that uses this extension knows that the minimum was enforced whenever that credential is used. In order to prevent just any site from requesting this information, the security key will only report the current minimum PIN length for sites that have been explicitly preconfigured. This configuration has to be done directly, by sending special CTAP messages <https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authent…> to the security key. This API is not exposed over the internet. The envisioned process is that an enterprise will enable minimum PIN length reporting for its sign-in domain manually, on each security key, before distributing them to employees. The CTAP 2.1 minPinLength extension can be exposed to the Web via WebAuthn's existing extensions mechansim <https://www.w3.org/TR/webauthn-2/#sctn-authenticator-extension-processing>. This request is being submitted as part of the Blink process because Blink proposes to so expose it. Cheers AGL

1 0

Request for position: new window.open() behavior
by Mason Freed 19 Nov '21

19 Nov '21

Hi WebKit, I'd like to get WebKit's position on some changes that were recently made to the spec <https://github.com/whatwg/html/issues/5872> for window.open(). Chromium is planning to ship <https://groups.google.com/a/chromium.org/g/blink-dev/c/q6ybnmxxvpE/m/2snoh6…> these new behaviors soon. The chromestatus entry <https://chromestatus.com/feature/5663031909416960> has the full details, but in essence, this makes two changes to the spec. First is that a new windowFeature value, 'popup', can be used to explicitly trigger a popup (popup=1) vs. a window/tab (popup=0). The other change is that the BarProp.visible properties will all return the same values, true for tab/window, false for popup. We do not believe either of these changes should cause compat problems, but we'll monitor for bugs as we roll it out. These changes simplify the usage of window.open() and work toward better interop in this area. We're hopeful that you're supportive of this change. Thanks, Mason

1 0

Intent to Ship Sec-CH-UA-Full-Version-List User Agent Client Hint
by Victor Tan 17 Nov '21

17 Nov '21

Hi, We are going to ship a new client hint Sec-CH-UA-Full-Version-List. Please let us know if you have any questions or comments. You can check the following documents for details: * https://github.com/WICG/ua-client-hints/issues/196 * https://wicg.github.io/ua-client-hints/#sec-ch-ua-full-version-list Bests, Victor

1 0

Patrick Angle is now a WebKit reviewer!
by Devin Rousso 16 Nov '21

16 Nov '21

Hi! I am thrilled to announce that Patrick Angle is now a WebKit reviewer. Patrick has done a lot of work in Web Inspector, ranging from the smallest bugfixes to larger projects like the inspected page CSS grid overlay. Please join me in congratulating Patrick on his reviewer status! \(0.0)/ Thanks, Devin

1 0

How to set up Intellisense-ish code completion/suggestions for editing WebKit sources on macOS?
by Michael[tm] Smith 11 Nov '21

11 Nov '21

Can anyone recommend a combination of text-editor/IDE, plugins/tooling (e.g., language server), and settings/config that’ll enable me to have usable code-(auto)completion/suggestions (like Intellisense, etc.) when editing WebKit sources in a macOS environment? Specifically, I mean the particular type of code completion you get when you type the name of some instance of an object in your editor, and then a dot, and the editor then shows you a popup with the names of all the available member functions and data members you can use with that object. Over the last several days, I have been trying (and failing) in multiple text editors to get working code completion like that set up for editing WebKit sources. A big reason it doesn’t work with the WebKit sources is that all the text editors and tooling don’t seem to be able to find the header files referenced in the various .cpp sources — beginning with #include "config.h", but others as well. I’m a diehard vim user, so I started out trying the available vim plugins that integrate with clangd. And the big problem I ran into there was that clangd relies on having a compile_commands.json file to work from — which (as far as I understand) essentially can’t be generated from the WebKit sources when building the macOS port (I have gleaned that’s in part due to the fact it’s a Unified build, which confuses clangd). So the next thing I tried was integrating with ccls. That seems to work to the point of ccls successfully generating an index of sources — but then when I open a file to edit, I immediately get an error about ccls not being able to resolve the #include “config.h” reference — and the multiple errors about macro references it can’t resolve. ...And then, ultimately, no completion suggests when I put a dot after a particular object name I want to get the function and data-member suggestions for. (It seems to work for some objects, but not others.) I like ccls though, and I think (hope) it may be that if I set up my .ccls file with the right options for helping it find the header files it needs, it may actually end up working. But my current .ccls isn’t doing that. Anyway, the last thing I’ve been trying is Visual Studio Code. In that I tried with both the clangd extension and the ccls extension, but ended up having basically the same problems I have with the vim integrations. So I switched back to trying the Microsoft-provided C/C++ Intellisense extension (cpptools), and found that seems to work better than the clangd or ccls extensions — at least so far as it seems to be able to at last partially resolve the header include references. But then it too seems to stumble on not being able to find some headers it needs. For example, I think I’ve been able to make it figure out #include "config.h" — but then the next problem I hit is stuff like this: cannot open source file "JavaScriptCore/JSExportMacros.h" (dependency of "config.h") ...And then anyway, again, ultimately, no completion suggests when I put a dot after a particular object name I want to get the function and data-member suggestions for. (It seems to work for some objects, but not others.) So I’m hoping others here might have something working successfully in their environments that gives them proper completion suggestions on member- function names and data-member names. –Mike -- Michael[tm] Smith https://people.w3.org/mike

4 3

Request for opinion: Private Network Access preflights
by Titouan Rigoudy 10 Nov '21

10 Nov '21

Hi there friendly WebKittens, I have been implementing the second step of Private Network Access (PNA) [1] in Chromium. When a website served over HTTP from a public IP addres makes a subresource request to a private (RFC1918) IP address or localhost, Chrome will send a CORS preflight request with an extra PNA-specific header ahead of the actual request. This change also affects websites served from private IP addresses making subresource requests to localhost. The idea is to ask the target server whether it wants to opt into being contacted from the public internet. Most endpoints on the private network probably do not expect to receive such requests, and are often vulnerable to CSRF attacks. We have metrics in place telling us that ~1% of page visits at most make use of this feature, with a fairly clear weekly pattern suggesting use in work contexts. I am interested in WebKit's opinion on this matter. For more details, see the chromestatus entry [2]. Cheers, Titouan [1] https://wicg.github.io/private-network-access/ [2] https://chromestatus.com/feature/5737414355058688

1 1

Peng Liu is now a WebKit reviewer!
by Daniel Bates 09 Nov '21

09 Nov '21

I am delighted to announce that Peng Liu is now a WebKit reviewer. Peng has done a lot of work in WebKit media. Most recently he has helped enable media features in the GPU process. Please join me in congratulating Peng on his reviewer status!

1 0

Request for position on Subresource loading with Web Bundles
by Hayato Ito 09 Nov '21

09 Nov '21

Hi webkit-dev. I'd like to request WebKit's official position on Subresource loading with Web Bundles. The features provides a new approach to load a large number of resources efficiently using a format that allows multiple resources to be bundled, Web Bundles. Specification Title: Subresource loading with Web Bundles Specification or proposal URL: https://github.com/WICG/webpackage/blob/main/explainers/subresource-loading… Chrome status page: https://chromestatus.com/feature/5710618575241216 -- Hayato

1 0

Cameron McCormack is now a WebKit reviewer!
by Myles Maxfield 09 Nov '21

09 Nov '21

Hello! I am delighted to announce that Cameron McCormack is now a WebKit reviewer. Congratulations, Cameron!

1 0

Review request time limit
by Alex Christensen 01 Nov '21

01 Nov '21

I just removed r? on all the bugs in http://webkit.org/pending-review <http://webkit.org/pending-review> that had requested review in 2018 or before and had been untouched since then. I imagine that did not interrupt anyone’s work. I was thinking of removing review requests on bugs that hadn’t been updated in one full year to maintain the usefulness of the review queue. Does anyone have any strong opinions that that is too much time or too little time? Most reviews are done in a few days or weeks, but occasionally something useful sits in the review queue for a few months.

2 1