From 7e84388e4d0323e418f3d85e9321c781ab6c5f7c Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Wed, 20 Nov 2024 19:10:41 +0000
Subject: [PATCH] Merge pull request #2197 from w3c/level3

SHA: 3bba180028005ff7cbb60ae4cff6330dde0398a0
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/index.html b/index.html
index 34626e2d7..4041c0b90 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 742f3d674, updated Mon Nov 4 14:56:54 2024 -0800" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="e2987a9e30186cf588ad262a904b535b896aaaee" name="revision">
+  <meta content="3bba180028005ff7cbb60ae4cff6330dde0398a0" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -5031,7 +5031,7 @@ <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span cl
    <p>This can make deployment challenging for large environments where multiple country-specific domains are in use (e.g. example.com vs example.co.uk vs example.sg), where alternative or brand domains are required (e.g. myexampletravel.com vs examplecruises.com), and/or where platform as a service providers are used to support mobile apps.</p>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Parties</a> can opt in to allowing <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑥">WebAuthn Clients</a> to enable a credential to be created and used across a limited set of related <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origins</a>.
 Such <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> MUST choose a common <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> to use across all ceremonies from related origins.</p>
-   <p>A JSON document MUST be hosted at the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a>. The JSON document MUST be returned as follows:</p>
+   <p>A JSON document MUST be hosted at the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a>, and MUST be served using HTTPS. The JSON document MUST be returned as follows:</p>
    <ul>
     <li data-md>
      <p>The content type MUST be <code>application/json</code>.</p>
@@ -5055,14 +5055,16 @@ <h3 class="heading settled" data-level="5.11" id="sctn-related-origins"><span cl
 <c- p>}</c->
 </pre>
    <p><a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑦">WebAuthn Clients</a> supporting this feature MUST support at least five <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label①">registrable origin labels</a>. Client policy SHOULD define an upper limit to prevent abuse.</p>
-   <p><a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑧">WebAuthn Clients</a> supporting this feature SHOULD include <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-relatedorigins" id="ref-for-dom-clientcapability-relatedorigins①">relatedOrigins</a></code> in their response to <a href="#sctn-getClientCapabilities">getClientCapabilities()</a>.</p>
+   <p>Requests to this well-known endpoint by <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑧">WebAuthn Clients</a> MUST be made without <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode">credentials</a>, without a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy">referrer</a>,
+and using the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a>. When following redirects, <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑨">WebAuthn Clients</a> MUST explicitly require all redirects to also use the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme②">scheme</a>.</p>
+   <p><a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⓪">WebAuthn Clients</a> supporting this feature SHOULD include <code class="idl"><a data-link-type="idl" href="#dom-clientcapability-relatedorigins" id="ref-for-dom-clientcapability-relatedorigins①">relatedOrigins</a></code> in their response to <a href="#sctn-getClientCapabilities">getClientCapabilities()</a>.</p>
    <h4 class="heading settled" data-level="5.11.1" id="sctn-validating-relation-origin"><span class="secno">5.11.1. </span><span class="content">Validating Related Origins</span><a class="self-link" href="#sctn-validating-relation-origin"></a></h4>
    <p>The <dfn class="dfn-paneled" data-dfn-type="abstract-op" data-export id="abstract-opdef-related-origins-validation-procedure">related origins validation procedure</dfn>, given arguments <var>callerOrigin</var> and <var>rpIdRequested</var>, is as follows:</p>
    <ol>
     <li data-md>
      <p>Let <var>maxLabels</var> be the maximum number of <a data-link-type="dfn" href="#registrable-origin-label" id="ref-for-registrable-origin-label②">registrable origin labels</a> allowed by client policy.</p>
     <li data-md>
-     <p>Fetch the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the RP ID <var>rpIdRequested</var> (i.e., <code>https://<var>rpIdRequested</var>/.well-known/webauthn</code>).</p>
+     <p>Fetch the <code>webauthn</code> well-known URL <a data-link-type="biblio" href="#biblio-rfc8615" title="Well-Known Uniform Resource Identifiers (URIs)">[RFC8615]</a> for the RP ID <var>rpIdRequested</var> (i.e., <code>https://<var>rpIdRequested</var>/.well-known/webauthn</code>) without <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode①">credentials</a>, without a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy①">referrer</a> and using the <code>https:</code> <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-scheme" id="ref-for-concept-url-scheme③">scheme</a>.</p>
      <ol>
       <li data-md>
        <p>If the fetch fails, the response does not have a content type of <code>application/json</code>, or does not have a status code (after following redirects) of 200, then throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror①①">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException③⓪">DOMException</a></code>.</p>
@@ -5536,7 +5538,7 @@ <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-ca
    <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>.
 The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
-   <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑨">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
+   <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②①">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
 session to exist at any particular time, or by providing more complicated session management.</p>
    <p>The following operations can be invoked by the client in an authenticator session.</p>
@@ -5902,7 +5904,7 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
 The following subsections define requirements for how clients and authenticators,
 respectively, may perform string truncation.</p>
    <h5 class="heading settled" data-level="6.4.1.1" id="sctn-strings-truncation-client"><span class="secno">6.4.1.1. </span><span class="content">String Truncation by Clients</span><a class="self-link" href="#sctn-strings-truncation-client"></a></h5>
-   <p>When a <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⓪">WebAuthn Client</a> truncates a string,
+   <p>When a <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②②">WebAuthn Client</a> truncates a string,
 the truncation behaviour observable by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> MUST satisfy the following requirements:</p>
    <p>Choose a size limit equal to or greater than the specified minimum supported length.
 The string MAY be truncated so that its length in bytes in the UTF-8 character encoding satisfies that limit.
@@ -7720,7 +7722,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
    </dl>
    <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors-webauthn"><span class="secno">10.1.4.1. </span><span class="content">Test vectors: Web Authentication API</span><a class="self-link" href="#prf-extension-test-vectors-webauthn"></a></h5>
    <p><em>This section is not normative.</em></p>
-   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②①">WebAuthn Client</a> implementations of and <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Party</a> usage of the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a> implementations of and <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⓪">WebAuthn Relying Party</a> usage of the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
 The examples are not exhaustive.</p>
    <ul>
     <li data-md>
@@ -7814,7 +7816,7 @@ <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors
    </ul>
    <h5 class="heading settled" data-level="10.1.4.2" id="prf-extension-test-vectors-ctap"><span class="secno">10.1.4.2. </span><span class="content">Test vectors: CTAP2 <code>hmac-secret</code> extension</span><a class="self-link" href="#prf-extension-test-vectors-ctap"></a></h5>
    <p><em>This section is not normative.</em></p>
-   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②②">WebAuthn Client</a> implementations
+   <p>The following examples may be used to test <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Client</a> implementations
 of how the <a data-link-type="dfn" href="#prf" id="ref-for-prf②">prf</a> extension uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension.
 The examples are given in CDDL <a data-link-type="biblio" href="#biblio-rfc8610" title="Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures">[RFC8610]</a> notation.
 The examples are not exhaustive.</p>
@@ -8783,7 +8785,7 @@ <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><s
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
 The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑥⑤">WebAuthn Relying Party</a>'s
 computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②③">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑤">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Parties</a>.
 Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
 Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> security characteristics.</p>
@@ -8926,7 +8928,7 @@ <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-det
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②④">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client②⑥">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
 which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
@@ -10046,6 +10048,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="b0fcb8d7">UTF-8 decode</span>
      <li><span class="dfn-paneled" id="0303e8e5">UTF-8 encode</span>
     </ul>
+   <li>
+    <a data-link-type="biblio">[FETCH]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="902380f7">credentials mode</span>
+     <li><span class="dfn-paneled" id="07582c28">referrer policy</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[FIDO-APPID]</a> defines the following terms:
     <ul>
@@ -10324,6 +10332,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd><a href="https://tc39.es/ecma262/multipage/"><cite>ECMAScript Language Specification</cite></a>. URL: <a href="https://tc39.es/ecma262/multipage/">https://tc39.es/ecma262/multipage/</a>
    <dt id="biblio-encoding">[ENCODING]
    <dd>Anne van Kesteren. <a href="https://encoding.spec.whatwg.org/"><cite>Encoding Standard</cite></a>. Living Standard. URL: <a href="https://encoding.spec.whatwg.org/">https://encoding.spec.whatwg.org/</a>
+   <dt id="biblio-fetch">[FETCH]
+   <dd>Anne van Kesteren. <a href="https://fetch.spec.whatwg.org/"><cite>Fetch Standard</cite></a>. Living Standard. URL: <a href="https://fetch.spec.whatwg.org/">https://fetch.spec.whatwg.org/</a>
    <dt id="biblio-fido-appid">[FIDO-APPID]
    <dd>D. Balfanz; et al. <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html"><cite>FIDO AppID and Facet Specification</cite></a>. 27 February 2018. FIDO Alliance Implementation Draft. URL: <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html">https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html</a>
    <dt id="biblio-fido-ctap">[FIDO-CTAP]
@@ -11315,8 +11325,9 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "0204d188": {"dfnID":"0204d188","dfnText":"size","external":true,"refSections":[{"refs":[{"id":"ref-for-list-size"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-size\u2460"},{"id":"ref-for-list-size\u2461"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://infra.spec.whatwg.org/#list-size"},
 "0303e8e5": {"dfnID":"0303e8e5","dfnText":"UTF-8 encode","external":true,"refSections":[{"refs":[{"id":"ref-for-utf-8-encode"}],"title":"8.5. Android SafetyNet Attestation Statement Format"}],"url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
 "03afaf9c": {"dfnID":"03afaf9c","dfnText":"empty","external":true,"refSections":[{"refs":[{"id":"ref-for-list-empty"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-list-empty\u2460"},{"id":"ref-for-list-empty\u2461"},{"id":"ref-for-list-empty\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-list-empty\u2463"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-list-empty\u2464"},{"id":"ref-for-list-empty\u2465"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-list-empty\u2466"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-list-empty\u2467"}],"title":"14.6.3. Privacy leak via credential IDs"}],"url":"https://infra.spec.whatwg.org/#list-empty"},
+"07582c28": {"dfnID":"07582c28","dfnText":"referrer policy","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-referrer-policy"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-request-referrer-policy\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://fetch.spec.whatwg.org/#concept-request-referrer-policy"},
 "0e6b2056": {"dfnID":"0e6b2056","dfnText":"set (for map)","external":true,"refSections":[{"refs":[{"id":"ref-for-map-set"},{"id":"ref-for-map-set\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2461"},{"id":"ref-for-map-set\u2462"},{"id":"ref-for-map-set\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-map-set\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-map-set\u2465"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"https://infra.spec.whatwg.org/#map-set"},
-"118b92bb": {"dfnID":"118b92bb","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"}],"title":"3. Dependencies"}],"url":"https://url.spec.whatwg.org#concept-url-scheme"},
+"118b92bb": {"dfnID":"118b92bb","dfnText":"scheme","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-scheme"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-scheme\u2460"},{"id":"ref-for-concept-url-scheme\u2461"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-url-scheme\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://url.spec.whatwg.org#concept-url-scheme"},
 "1243a891": {"dfnID":"1243a891","dfnText":"exist","external":true,"refSections":[{"refs":[{"id":"ref-for-map-exists"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-map-exists\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-map-exists\u2461"},{"id":"ref-for-map-exists\u2462"},{"id":"ref-for-map-exists\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-map-exists\u2464"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-map-exists\u2465"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-map-exists\u2466"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"https://infra.spec.whatwg.org/#map-exists"},
 "12b8dfc0": {"dfnID":"12b8dfc0","dfnText":"current settings object","external":true,"refSections":[{"refs":[{"id":"ref-for-current-settings-object"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-current-settings-object\u2460"}],"title":"5.9. Permissions Policy integration"}],"url":"https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object"},
 "14fea63d": {"dfnID":"14fea63d","dfnText":"own property","external":true,"refSections":[{"refs":[{"id":"ref-for-sec-own-property"}],"title":"11.3. Add Virtual Authenticator"}],"url":"https://tc39.github.io/ecma262/#sec-own-property"},
@@ -11411,6 +11422,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "8da4d1e3": {"dfnID":"8da4d1e3","dfnText":"invalid argument","external":true,"refSections":[{"refs":[{"id":"ref-for-dfn-invalid-argument"}],"title":"11.1. WebAuthn WebDriver Extension Capability"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461"},{"id":"ref-for-dfn-invalid-argument\u2462"},{"id":"ref-for-dfn-invalid-argument\u2463"},{"id":"ref-for-dfn-invalid-argument\u2464"}],"title":"11.3. Add Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2465"}],"title":"11.4. Remove Virtual Authenticator"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2466"},{"id":"ref-for-dfn-invalid-argument\u2467"},{"id":"ref-for-dfn-invalid-argument\u2468"},{"id":"ref-for-dfn-invalid-argument\u2460\u24ea"},{"id":"ref-for-dfn-invalid-argument\u2460\u2460"},{"id":"ref-for-dfn-invalid-argument\u2460\u2461"},{"id":"ref-for-dfn-invalid-argument\u2460\u2462"},{"id":"ref-for-dfn-invalid-argument\u2460\u2463"},{"id":"ref-for-dfn-invalid-argument\u2460\u2464"},{"id":"ref-for-dfn-invalid-argument\u2460\u2465"},{"id":"ref-for-dfn-invalid-argument\u2460\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2467"}],"title":"11.6. Get Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2460\u2468"},{"id":"ref-for-dfn-invalid-argument\u2461\u24ea"}],"title":"11.7. Remove Credential"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2460"}],"title":"11.8. Remove All Credentials"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2461"},{"id":"ref-for-dfn-invalid-argument\u2461\u2462"},{"id":"ref-for-dfn-invalid-argument\u2461\u2463"}],"title":"11.9. Set User Verified"},{"refs":[{"id":"ref-for-dfn-invalid-argument\u2461\u2464"},{"id":"ref-for-dfn-invalid-argument\u2461\u2465"},{"id":"ref-for-dfn-invalid-argument\u2461\u2466"}],"title":"11.10. Set Credential Properties"}],"url":"https://w3c.github.io/webdriver/#dfn-invalid-argument"},
 "8de17130": {"dfnID":"8de17130","dfnText":"valid domain string","external":true,"refSections":[{"refs":[{"id":"ref-for-valid-domain-string"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-valid-domain-string\u2460"},{"id":"ref-for-valid-domain-string\u2461"}],"title":"4. Terminology"}],"url":"https://url.spec.whatwg.org/#valid-domain-string"},
 "8f5c2179": {"dfnID":"8f5c2179","dfnText":"a promise resolved with","external":true,"refSections":[{"refs":[{"id":"ref-for-a-promise-resolved-with"}],"title":"5.1.10.1. Asynchronous RP ID validation algorithm"}],"url":"https://webidl.spec.whatwg.org/#a-promise-resolved-with"},
+"902380f7": {"dfnID":"902380f7","dfnText":"credentials mode","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-request-credentials-mode"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-concept-request-credentials-mode\u2460"}],"title":"5.11.1. Validating Related Origins"}],"url":"https://fetch.spec.whatwg.org/#concept-request-credentials-mode"},
 "91748ad6": {"dfnID":"91748ad6","dfnText":"default allowlists","external":true,"refSections":[{"refs":[{"id":"ref-for-policy-controlled-feature-default-allowlist"}],"title":"5.9. Permissions Policy integration"}],"url":"https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist"},
 "944c2033": {"dfnID":"944c2033","dfnText":"credential source","external":true,"refSections":[{"refs":[{"id":"ref-for-credential-source"}],"title":"4. Terminology"}],"url":"https://w3c.github.io/webappsec-credential-management/#credential-source"},
 "984221ca": {"dfnID":"984221ca","dfnText":"struct","external":true,"refSections":[{"refs":[{"id":"ref-for-struct"},{"id":"ref-for-struct\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-struct\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct\u2462"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-struct\u2463"},{"id":"ref-for-struct\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"https://infra.spec.whatwg.org/#struct"},
@@ -12001,7 +12013,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "web-application": {"dfnID":"web-application","dfnText":"web application","external":false,"refSections":[{"refs":[{"id":"ref-for-web-application\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-application\u2461"},{"id":"ref-for-web-application\u2462"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-web-application\u2463"}],"title":"11. User Agent Automation"},{"refs":[{"id":"ref-for-web-application\u2464"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-web-application\u2465"}],"title":"13. Security Considerations"}],"url":"#web-application"},
 "web-authentication-api": {"dfnID":"web-authentication-api","dfnText":"Web Authentication API","external":false,"refSections":[{"refs":[{"id":"ref-for-web-authentication-api"},{"id":"ref-for-web-authentication-api\u2460"},{"id":"ref-for-web-authentication-api\u2461"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-web-authentication-api\u2462"},{"id":"ref-for-web-authentication-api\u2463"},{"id":"ref-for-web-authentication-api\u2464"},{"id":"ref-for-web-authentication-api\u2465"},{"id":"ref-for-web-authentication-api\u2466"},{"id":"ref-for-web-authentication-api\u2467"},{"id":"ref-for-web-authentication-api\u2468"},{"id":"ref-for-web-authentication-api\u2460\u24ea"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2460"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2463"}],"title":"5.9. Permissions Policy integration"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2464"},{"id":"ref-for-web-authentication-api\u2460\u2465"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2466"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-web-authentication-api\u2460\u2467"},{"id":"ref-for-web-authentication-api\u2460\u2468"}],"title":"14.1. De-anonymization Prevention Measures"}],"url":"#web-authentication-api"},
 "webauthn-authenticator": {"dfnID":"webauthn-authenticator","dfnText":"WebAuthn Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-authenticator"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460"}],"title":"2.2. Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2461"},{"id":"ref-for-webauthn-authenticator\u2462"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2463"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2464"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2465"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2466"},{"id":"ref-for-webauthn-authenticator\u2467"}],"title":"6.4.1.2. String Truncation by Authenticators"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2468"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u24ea"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2460"},{"id":"ref-for-webauthn-authenticator\u2460\u2461"}],"title":"13.3.1. Attestation Certificate Hierarchy"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2462"},{"id":"ref-for-webauthn-authenticator\u2460\u2463"},{"id":"ref-for-webauthn-authenticator\u2460\u2464"},{"id":"ref-for-webauthn-authenticator\u2460\u2465"},{"id":"ref-for-webauthn-authenticator\u2460\u2466"},{"id":"ref-for-webauthn-authenticator\u2460\u2467"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-webauthn-authenticator\u2460\u2468"},{"id":"ref-for-webauthn-authenticator\u2461\u24ea"}],"title":"14.4.1. Attestation Privacy"}],"url":"#webauthn-authenticator"},
-"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"},{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"},{"id":"ref-for-webauthn-client\u2460\u2466"},{"id":"ref-for-webauthn-client\u2460\u2467"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2468"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u24ea"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2460"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2461"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2462"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2463"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
+"webauthn-client": {"dfnID":"webauthn-client","dfnText":"WebAuthn Client","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-webauthn-client\u2460"},{"id":"ref-for-webauthn-client\u2461"},{"id":"ref-for-webauthn-client\u2462"},{"id":"ref-for-webauthn-client\u2463"},{"id":"ref-for-webauthn-client\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-client\u2465"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-webauthn-client\u2466"},{"id":"ref-for-webauthn-client\u2467"},{"id":"ref-for-webauthn-client\u2468"},{"id":"ref-for-webauthn-client\u2460\u24ea"},{"id":"ref-for-webauthn-client\u2460\u2460"},{"id":"ref-for-webauthn-client\u2460\u2461"},{"id":"ref-for-webauthn-client\u2460\u2462"},{"id":"ref-for-webauthn-client\u2460\u2463"},{"id":"ref-for-webauthn-client\u2460\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-webauthn-client\u2460\u2465"},{"id":"ref-for-webauthn-client\u2460\u2466"},{"id":"ref-for-webauthn-client\u2460\u2467"},{"id":"ref-for-webauthn-client\u2460\u2468"},{"id":"ref-for-webauthn-client\u2461\u24ea"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2460"}],"title":"6.3. Authenticator Operations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2461"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2462"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2463"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2464"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-webauthn-client\u2461\u2465"}],"title":"13.4.8. Code injection attacks"}],"url":"#webauthn-client"},
 "webauthn-client-device": {"dfnID":"webauthn-client-device","dfnText":"WebAuthn Client Device","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-client-device"},{"id":"ref-for-webauthn-client-device\u2460"}],"title":"4. Terminology"}],"url":"#webauthn-client-device"},
 "webauthn-extensions": {"dfnID":"webauthn-extensions","dfnText":"WebAuthn Extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-webauthn-extensions"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2461"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-webauthn-extensions\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2464"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-webauthn-extensions\u2465"}],"title":"5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2466"}],"title":"5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2467"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2468"}],"title":"5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u24ea"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-webauthn-extensions\u2460\u2461"},{"id":"ref-for-webauthn-extensions\u2460\u2462"},{"id":"ref-for-webauthn-extensions\u2460\u2463"}],"title":"9. WebAuthn Extensions"}],"url":"#webauthn-extensions"},
 "webauthn-fido2-protocol": {"dfnID":"webauthn-fido2-protocol","dfnText":"WebAuthn/FIDO2 protocol","external":false,"refSections":[],"url":"#webauthn-fido2-protocol"},
@@ -12884,6 +12896,8 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 "https://dom.spec.whatwg.org/#document": {"displayText":"Document","export":true,"for_":[],"level":"1","normative":true,"shortname":"dom","spec":"dom","status":"current","text":"Document","type":"interface","url":"https://dom.spec.whatwg.org/#document"},
 "https://encoding.spec.whatwg.org/#utf-8-decode": {"displayText":"UTF-8 decode","export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 decode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-decode"},
 "https://encoding.spec.whatwg.org/#utf-8-encode": {"displayText":"UTF-8 encode","export":true,"for_":[],"level":"1","normative":true,"shortname":"encoding","spec":"encoding","status":"current","text":"utf-8 encode","type":"dfn","url":"https://encoding.spec.whatwg.org/#utf-8-encode"},
+"https://fetch.spec.whatwg.org/#concept-request-credentials-mode": {"displayText":"credentials mode","export":true,"for_":["request"],"level":"1","normative":true,"shortname":"fetch","spec":"fetch","status":"current","text":"credentials mode","type":"dfn","url":"https://fetch.spec.whatwg.org/#concept-request-credentials-mode"},
+"https://fetch.spec.whatwg.org/#concept-request-referrer-policy": {"displayText":"referrer policy","export":true,"for_":["request"],"level":"1","normative":true,"shortname":"fetch","spec":"fetch","status":"current","text":"referrer policy","type":"dfn","url":"https://fetch.spec.whatwg.org/#concept-request-referrer-policy"},
 "https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats": {"displayText":"Section 3.6.2 Public Key Representation Formats","export":true,"for_":["FIDO-Registry"],"level":"","normative":true,"shortname":"fido-registry","spec":"fido-registry","status":"anchor-block","text":"section 3.6.2 public key representation formats","type":"dfn","url":"https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats"},
 "https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate": {"displayText":"application parameter","export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"application parameter","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate"},
 "https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success": {"displayText":"Section 5.4","export":true,"for_":["FIDO-U2F-Message-Formats"],"level":"","normative":true,"shortname":"fido-u2f-message-formats","spec":"fido-u2f-message-formats","status":"anchor-block","text":"section 5.4","type":"dfn","url":"https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success"},