2 ms·
Not true.
by dboreham 3y ago
Not true.
- pseudo0 3y agoThe signed assertion includes the clientDataJSON, which contains the origin of the relying party. Assuming the server properly validates that assertion, it should prevent the use of a phished assertion by a third party. https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion https://developer.mozilla.org/en-US/docs/Web/API/Web_Authent...