mikewest / credentialmanagement Goto Github PK

In https://mikewest.github.io/credentialmanagement/writeonly/#opaque-formdata step 3.1 needs to discuss fetch().

Fetch was updated today (sorry) and the "as generic" algorithm is now "consume body".

I suspect you also need to patch Response as otherwise it could be used to make FormData less opaque. Which I think indicates this needs to be sorted at FormData's serialization level rather than a per-API thing.

From a conversation with @slightlyoff:

1. Return an opaque FormData object instead of raw username/password.
2. Limit submission of said FormData via connect-src (XHR) and form-action (POST).
3. Maybe an 'unsafe' flag of some sort to return raw credentials if crazy websites want to be crazy?
4. Maybe a no-unsafe flag of some sort to stop #3 from leaking data via XSS? (Perhaps the CSP bits from http://projects.mikewest.org/credentialmanagement/writeonly/?)

philipj suggests that we take a dictionary instead, which seems pretty reasonable.

Regarding the last line in the README.md file:

"Specifiction ... http://specifiction.org"

Opening http://specifiction.org results in:

Warning! specifiction.org has expired.

(The HTTPS version results in "Unable to connect".)