1822703 - Remove Google's cross-origin AppID exceptions

Status: RESOLVED INACTIVE

(Core :: DOM: Web Authentication, enhancement, P5)

Description

[John Schanck [:jschanck]]

The cross-origin exception for U2F credentials with an AppId of https://www.gstatic.com/securitykey/origins.json or https://www.gstatic.com/securitykey/a/google.com/origins.json expired in January 2023. We removed some constants related to these exceptions in Bug 1436085, but the exceptions are still present in our WebAuthn implementation. We can remove them now.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1822703 - Remove Google's cross-origin AppID exceptions. r=dveditz

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2f8883507c91
Remove Google's cross-origin AppID exceptions. r=dveditz

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/2f8883507c91

Comment 4

[Narcis Beleuzu [:NarcisB]]

Backed out as requested by jschanck for causing WebAuthn login issues with Google Accounts

Backout link: https://hg.mozilla.org/integration/autoland/rev/499bc4d69280ad7753ed00be658ad3c3737b96d4

Comment 5

[John Schanck [:jschanck]]

I asked a contact at Google, and they believe that we'll need to keep these exceptions "pretty much indefinitely".

Comment 6

[Daniel Veditz [:dveditz]]

Should we resolve this bug "wontfix"? "inactive" would also work.