Handling various origin types

[marcoscaceres]

When calling .get(), we need to check:

• origin is opaque origin? Throw SecurityError.
• is the effective domain a valid domain? no, then throw SecurityError.

As with Web Auth, we probably don't want IP addresses being compared here.

[OR13]

What's an example of an invalid domain?

I assume you don't plan to do any TLSA or DNSSEC checks. The domain could be any DNS resolvable IDNA, according to UTS46.

Right?

[samuelgoto]

navigator.identity is already protected under SecureContext, wouldn't this already cover "origin is opaque origin?" and "is the effective domain a valid domain?"?

[timcappalli]

navigator.identity is already protected under SecureContext, wouldn't this already cover "origin is opaque origin?" and "is the effective domain a valid domain?"?

That is my understanding. @marcoscaceres does this match your understanding as well?