WebAuthn related-origin requests

Component: WebKit WebAuthn | 86e9570

WebAuthn normally requires the calling origin's registrable domain to match the relying party (RP) ID exactly, which is what prevents one site from minting or asserting credentials scoped to another. The "related origin requests" extension relaxes that: an RP can publish a JSON list of related origins at a well-known path, and the browser fetches and validates it before honoring a mismatched-origin request.

This commit implements that. When a page's origin does not match the RP ID it is requesting, WebKit fetches the RP's well-known JSON resource from the UIProcess — bounded by size, timeout, redirect policy and MIME type — and checks whether the calling origin appears in the returned list, rejecting with SecurityError otherwise. It adds WellKnownOriginList (WebCore, parsing and matching free functions), WellKnownResourceFetcher and RelatedOriginsValidation (WebKit, fetch and validation glue), and a new WKUIDelegatePrivate SPI (...relatedOrigins:completionHandler:) that forwards the validated related origins to the embedding app, alongside 33 unit tests and 15 API tests.

Significance

WebKit now makes a credential-scoping trust decision from network-controlled data: the RP's own JSON response, fetched over a redirect chain whatever server answers for the RP ID's host controls. The fetch target, response body and redirect chain are all outside WebKit's control, so the correctness of the fetch bounds and the origin-matching logic is what stands between this feature and treating an untrusted origin as authorized.

Audit directions

The forward-facing pattern is a security decision made from a fetched document, where the fetch's bounds are as load-bearing as the parser's correctness. WellKnownOriginList's parsing and matching functions are the obvious start — origin comparison that is not exact string matching on a canonicalized form has a long history of near-miss bypasses. Just as important, and easier to overlook: the redirect policy in WellKnownResourceFetcher, since a redirect that crosses to a host the RP does not control converts "the RP published this list" into "someone else did". The same shape recurs anywhere WebKit fetches a well-known resource to authorize something — audit the other well-known fetchers for whether their redirect and MIME handling is as tight as this one's.

---