From 517fa2ca82096175fada102a2a6e485d0c6256c8 Mon Sep 17 00:00:00 2001 From: Joost de Valk Date: Tue, 8 Sep 2026 08:08:28 +0200 Subject: [PATCH] change(webauthn): Level 3 is a W3C Recommendation as of 25 August 2026 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit WebAuthn Level 3 — the edition that added Related Origin Requests, and so the reason /.well-known/webauthn exists at all — reached W3C Recommendation on 25 August 2026. The page cited it as a bare /TR/ URL and called ROR "in the W3C standard", which was true but vague while Level 3 was still a working draft. Named the source as a Recommendation and said so in the prose. No date is pinned in the source title: ARIA in HTML (#177) showed that naming the current edition's date rots within weeks once a REC starts being amended. "Reached Recommendation in August 2026" is a fact that does not move. Status stays `optional`. ROR still only applies to sites running passkeys across more than one origin; a Recommendation does not widen who needs the file. Co-Authored-By: Claude Opus 5 (1M context) --- src/content/spec/well-known/webauthn.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/content/spec/well-known/webauthn.md b/src/content/spec/well-known/webauthn.md index 50e9021b..30f0362c 100644 --- a/src/content/spec/well-known/webauthn.md +++ b/src/content/spec/well-known/webauthn.md @@ -7,9 +7,9 @@ status: optional appliesTo: [all] relatedSlugs: [well-known-overview, change-password, https-tls, accessible-authentication] order: 25 -updated: "2026-06-08T12:00:00.000Z" +updated: "2026-09-08T00:00:00.000Z" sources: - - title: "Web Authentication: An API for accessing Public Key Credentials — Level 3" + - title: "Web Authentication: An API for accessing Public Key Credentials — Level 3 (W3C Recommendation)" url: "https://www.w3.org/TR/webauthn-3/" publisher: "W3C Web Authentication Working Group" - title: "IANA — Well-Known URIs Registry" @@ -22,7 +22,7 @@ sources: ## What it is -`/.well-known/webauthn` is a JSON document that lists the origins permitted to create and use [passkeys](https://www.w3.org/TR/webauthn-3/) scoped to a single Relying Party ID (RP ID). It is the discovery file behind **Related Origin Requests (ROR)**, a feature added in WebAuthn Level 3. +`/.well-known/webauthn` is a JSON document that lists the origins permitted to create and use [passkeys](https://www.w3.org/TR/webauthn-3/) scoped to a single Relying Party ID (RP ID). It is the discovery file behind **Related Origin Requests (ROR)**, a feature added in WebAuthn Level 3, which reached W3C Recommendation in August 2026. A passkey is normally bound to one RP ID, which must match the registrable domain of the site using it. That breaks down when one organisation operates several domains — `example.com`, `example.co.uk`, `example.de` — and wants a single passkey to work across all of them. ROR lets a browser treat a request from a listed origin as valid for the RP ID, after fetching and checking this file. @@ -40,7 +40,7 @@ A passkey is normally bound to one RP ID, which must match the registrable domai - **One credential, many domains.** Users register a passkey once and sign in across every related property, instead of one passkey per ccTLD or brand domain. - **No shared secret or redirect dance.** The allowlist is a static, publicly fetchable file. The browser, not your servers, enforces it. -- **It is a platform feature, not a vendor one.** ROR is in the W3C standard and ships in Chrome, Safari, and Firefox (152+), so the behaviour is consistent across browsers. +- **It is a platform feature, not a vendor one.** ROR is in the W3C Recommendation and ships in Chrome, Safari, and Firefox (152+), so the behaviour is consistent across browsers. ## How to implement