Subject: [rtcweb] security-arch: 5.6.5.3.3: Managing User Login

From: Michael Procter <[email-masked]>
Date: Mon, 21 Jul 2014 19:21:42 -0400

In the security-arch draft, section 5.6.5.3.3 contains the following
in the penultimate paragraph:

   Once any user
   interactions are complete, the IFRAME MUST send a postMessage
   [WebMessaging] to its containing window indicating completion.  Any
   message is sufficient for this purpose, the "source" parameter
   identifies the originating IFRAME.

The "Any message is sufficient for this purpose" part appears to
conflict with the w3c draft section 8.2.1 which contains:

   The message MUST be the DOMString "LOGINDONE".

Given the choice between a null message and the string "LOGINDONE" I
am drawn to sending the string.  It seems to go well with the IdP
proxy protocol, and also gives an opportunity to extend it in the
future if needed (LOGINFAILED maybe?).

Rather than simply duplicating the string in the security-arch draft,
I suggest changing the end of that paragraph to:

   Once any user
   interactions are complete, the IFRAME MUST send a postMessage
   [WebMessaging] to its containing window indicating completion, as
   described in section 8.2.1 of [webrtc-api].

Regards,

Michael

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Jul 2014 08:50:56 -0700

>    described in section 8.2.1 of [webrtc-api].

Sounds like a good idea to me.

---

From: Michael Procter <[email-masked]>
Date: Tue, 22 Jul 2014 21:43:38 -0400

Pull request on github, issue 14