From ca55a6a0f3e425bdb61c85a5ce49773407f57403 Mon Sep 17 00:00:00 2001
From: Christian Biesinger <cbiesinger@chromium.org>
Date: Tue, 16 Jan 2024 19:08:32 +0000
Subject: [PATCH] Skip well-known check if RP and IDP are in the same site.
 (#535)

SHA: b3674e5b29186f6dd96dd7942d8fd30378cf369d
Reason: push, by samuelgoto

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 132 +++++++++++++++++++++++++++++------------------------
 1 file changed, 73 insertions(+), 59 deletions(-)

diff --git a/index.html b/index.html
index a2c32704..49ebf5f7 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://fedidcg.github.io/FedCM/" rel="canonical">
-  <meta content="828e96b472b0fad901a539636aba4861b248737d" name="document-revision">
+  <meta content="b3674e5b29186f6dd96dd7942d8fd30378cf369d" name="document-revision">
 <style>
 dl.domintro dt {
     font-family: Menlo, Consolas, "DejaVu Sans Mono", Monaco, monospace;
@@ -917,7 +917,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Federated Credential Management API</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2024-01-02">2 January 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2024-01-16">16 January 2024</time></p>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -2025,58 +2025,70 @@ <h4 class="heading settled" data-level="2.3.5" id="fetch-config-file"><span clas
       <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host">host</a> to <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host①">host</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain">registrable domain</a>.</p>
      <li data-md>
       <p>Set <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-path" id="ref-for-concept-url-path">path</a> to the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list①">list</a> «".well-known", "web-identity"».</p>
-     <li data-md>
-      <p>Let <var>wellKnownRequest</var> be a new <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request④">request</a> as follows:</p>
-      <dl>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url①">URL</a>
-       <dd data-md>
-        <p><var>rootUrl</var></p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client" id="ref-for-concept-request-client③">client</a>
-       <dd data-md>
-        <p>null</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window①">window</a>
-       <dd data-md>
-        <p>"no-window"</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#request-service-workers-mode" id="ref-for-request-service-workers-mode①">service-workers mode</a>
-       <dd data-md>
-        <p>"none"</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-destination" id="ref-for-concept-request-destination②">destination</a>
-       <dd data-md>
-        <p>"webidentity"</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin②">origin</a>
-       <dd data-md>
-        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a></p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list①">header list</a>
-       <dd data-md>
-        <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header②">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name①">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value①">value</a> set to <code>application/json</code></p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy">referrer policy</a>
-       <dd data-md>
-        <p>"no-referrer"</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode①">credentials mode</a>
-       <dd data-md>
-        <p>"omit"</p>
-       <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode①">mode</a>
-       <dd data-md>
-        <p>"no-cors"</p>
-      </dl>
-      <p class="issue" id="issue-8da66a63"><a class="self-link" href="#issue-8da66a63"></a> The spec is yet to be updated so that all <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request⑤">requests</a> are created
-with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode②">mode</a> set to "user-agent-no-cors". See the relevant <a href="https://github.com/whatwg/fetch/pull/1533">pull request</a> for details.</p>
      <li data-md>
       <p>Let <var>config</var>, <var>configInWellKnown</var> both be null.</p>
      <li data-md>
-      <p><a data-link-type="dfn" href="#fetch-request" id="ref-for-fetch-request①">Fetch request</a> with <var>wellKnownRequest</var> and <var>globalObject</var>, and with <var>processResponseConsumeBody</var> set to the following steps given a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response" id="ref-for-concept-response③">response</a> <var>response</var> and <var>responseBody</var>:</p>
+      <p>Let <var>rpOrigin</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑤">associated Document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin④">origin</a>.</p>
+     <li data-md>
+      <p>If <var>rpOrigin</var> is not an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque">opaque origin</a>, and <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host②">host</a> is equal
+to <var>rpOrigin</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-registrable-domain" id="ref-for-host-registrable-domain①">registrable domain</a>, and <var>rootUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme②">scheme</a> is
+equal to <var>rpOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme" id="ref-for-concept-origin-scheme">scheme</a>, set <var>configInWellKnown</var> to true.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> Because domain cookies are valid across an entire site, there is no privacy
+    benefit from doing the well-known check if the RP and IDP are in the same site.</p>
+     <li data-md>
+      <p>Otherwise:</p>
       <ol>
        <li data-md>
-        <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response①">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
-       <li data-md>
-        <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value①">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown">IdentityProviderWellKnown</a></code>, <var>discovery</var>.</p>
+        <p>Let <var>wellKnownRequest</var> be a new <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request④">request</a> as follows:</p>
+        <dl>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-url" id="ref-for-concept-request-url①">URL</a>
+         <dd data-md>
+          <p><var>rootUrl</var></p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-client" id="ref-for-concept-request-client③">client</a>
+         <dd data-md>
+          <p>null</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window①">window</a>
+         <dd data-md>
+          <p>"no-window"</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#request-service-workers-mode" id="ref-for-request-service-workers-mode①">service-workers mode</a>
+         <dd data-md>
+          <p>"none"</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-destination" id="ref-for-concept-request-destination②">destination</a>
+         <dd data-md>
+          <p>"webidentity"</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin②">origin</a>
+         <dd data-md>
+          <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a></p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list①">header list</a>
+         <dd data-md>
+          <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header②">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name①">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value①">value</a> set to <code>application/json</code></p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy">referrer policy</a>
+         <dd data-md>
+          <p>"no-referrer"</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-credentials-mode" id="ref-for-concept-request-credentials-mode①">credentials mode</a>
+         <dd data-md>
+          <p>"omit"</p>
+         <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode①">mode</a>
+         <dd data-md>
+          <p>"no-cors"</p>
+        </dl>
+        <p class="issue" id="issue-8da66a63"><a class="self-link" href="#issue-8da66a63"></a> The spec is yet to be updated so that all <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request⑤">requests</a> are created
+with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-mode" id="ref-for-concept-request-mode②">mode</a> set to "user-agent-no-cors". See the relevant <a href="https://github.com/whatwg/fetch/pull/1533">pull request</a> for details.</p>
        <li data-md>
-        <p>If one of the previous two steps threw an exception, or if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls">provider_urls</a></code>"] is
+        <p><a data-link-type="dfn" href="#fetch-request" id="ref-for-fetch-request①">Fetch request</a> with <var>wellKnownRequest</var> and <var>globalObject</var>, and with <var>processResponseConsumeBody</var> set to the following steps given a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-response" id="ref-for-concept-response③">response</a> <var>response</var> and <var>responseBody</var>:</p>
+        <ol>
+         <li data-md>
+          <p>Let <var>json</var> be the result of <a data-link-type="dfn" href="#extract-the-json-fetch-response" id="ref-for-extract-the-json-fetch-response①">extract the JSON fetch response</a> from <var>response</var> and <var>responseBody</var>.</p>
+         <li data-md>
+          <p><a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-convert-ecmascript-to-idl-value" id="ref-for-dfn-convert-ecmascript-to-idl-value①">Convert</a> <var>json</var> to an <code class="idl"><a data-link-type="idl" href="#dictdef-identityproviderwellknown" id="ref-for-dictdef-identityproviderwellknown">IdentityProviderWellKnown</a></code>, <var>discovery</var>.</p>
+         <li data-md>
+          <p>If one of the previous two steps threw an exception, or if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size①">size</a> of <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls">provider_urls</a></code>"] is
 greater than 1, set <var>configInWellKnown</var> to false.</p>
-        <p class="issue" id="issue-80d5b61c"><a class="self-link" href="#issue-80d5b61c"></a> <a href="https://github.com/fedidcg/FedCM/issues/333">relax</a> the size of the
+          <p class="issue" id="issue-80d5b61c"><a class="self-link" href="#issue-80d5b61c"></a> <a href="https://github.com/fedidcg/FedCM/issues/333">relax</a> the size of the
 provider_urls array.</p>
-       <li data-md>
-        <p>Otherwise, set to <var>configInWellKnown</var> to true if <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls①">provider_urls</a></code>"][0] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string-is" id="ref-for-string-is">is</a> equal to <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl⑨">configURL</a></code>, and to false otherwise.</p>
+         <li data-md>
+          <p>Otherwise, set to <var>configInWellKnown</var> to true if <var>discovery</var>["<code class="idl"><a data-link-type="idl" href="#dom-identityproviderwellknown-provider_urls" id="ref-for-dom-identityproviderwellknown-provider_urls①">provider_urls</a></code>"][0] <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string-is" id="ref-for-string-is">is</a> equal to <var>provider</var>’s <code class="idl"><a data-link-type="idl" href="#dom-identityproviderconfig-configurl" id="ref-for-dom-identityproviderconfig-configurl⑨">configURL</a></code>, and to false otherwise.</p>
+        </ol>
       </ol>
      <li data-md>
       <p>Let <var>configRequest</var> be a new <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request" id="ref-for-concept-request⑥">request</a> as follows:</p>
@@ -2101,7 +2113,7 @@ <h4 class="heading settled" data-level="2.3.5" id="fetch-config-file"><span clas
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin③">origin</a>
        <dd data-md>
-        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque①">opaque origin</a></p>
+        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a></p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list②">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list③">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header③">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name②">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value②">value</a> set to <code>application/json</code></p>
@@ -2203,7 +2215,7 @@ <h4 class="heading settled" data-level="2.3.6" id="fetch-accounts-list"><span cl
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin④">origin</a>
        <dd data-md>
-        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a></p>
+        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque③">opaque origin</a></p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list③">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header④">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name③">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value③">value</a> set to <code>application/json</code></p>
@@ -2283,7 +2295,7 @@ <h4 class="heading settled" data-level="2.3.6" id="fetch-accounts-list"><span cl
         <p>"image"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin⑤">origin</a>
        <dd data-md>
-        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque③">opaque origin</a></p>
+        <p>a unique <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque" id="ref-for-concept-origin-opaque④">opaque origin</a></p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-referrer-policy" id="ref-for-concept-request-referrer-policy③">referrer policy</a>
        <dd data-md>
         <p>"no-referrer"</p>
@@ -2362,7 +2374,7 @@ <h4 class="heading settled" data-level="2.3.7" id="fetch-identity-assertion"><sp
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin⑥">origin</a>
        <dd data-md>
-        <p><var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑤">associated document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin④">origin</a></p>
+        <p><var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑥">associated document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑤">origin</a></p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list④">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header⑤">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name④">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value④">value</a> set to <code>application/x-www-form-urlencoded</code></p>
@@ -2482,7 +2494,7 @@ <h4 class="heading settled" data-level="2.3.8" id="request-permission-signup"><s
         <p>"webidentity"</p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-origin" id="ref-for-concept-request-origin⑦">origin</a>
        <dd data-md>
-        <p><var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑥">associated document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑤">origin</a></p>
+        <p><var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑦">associated document</a>'s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑥">origin</a></p>
        <dt data-md><a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-header-list" id="ref-for-concept-request-header-list⑤">header list</a>
        <dd data-md>
         <p>a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑥">list</a> containing a single <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header" id="ref-for-concept-header⑥">header</a> with <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-name" id="ref-for-concept-header-name⑤">name</a> set to <code>Accept</code> and <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-header-value" id="ref-for-concept-header-value⑤">value</a> set to <code>application/json</code></p>
@@ -2698,7 +2710,7 @@ <h3 class="heading settled" data-level="2.4" id="browser-api-identity-provider-i
      <li data-md>
       <p>Let <var>globalObject</var> be the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object" id="ref-for-current-global-object①">current global object</a>.</p>
      <li data-md>
-      <p>Let <var>document</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑦">associated Document</a>.</p>
+      <p>Let <var>document</var> be <var>globalObject</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window" id="ref-for-concept-document-window⑧">associated Document</a>.</p>
      <li data-md>
       <p>If <var>document</var> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> the <a data-link-type="dfn" href="#identity-credentials-get" id="ref-for-identity-credentials-get①">identity-credentials-get</a> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①">policy-controlled feature</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
      <li data-md>
@@ -2708,7 +2720,7 @@ <h3 class="heading settled" data-level="2.4" id="browser-api-identity-provider-i
      <li data-md>
       <p>If <var>configUrl</var> is failure, throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code>.</p>
      <li data-md>
-      <p>If <var>document</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑥">origin</a> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin" id="ref-for-same-origin③">same origin</a> as <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-origin" id="ref-for-concept-url-origin③">origin</a>,
+      <p>If <var>document</var>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document-origin" id="ref-for-concept-document-origin⑦">origin</a> is not <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin" id="ref-for-same-origin③">same origin</a> as <var>configUrl</var>’s <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-origin" id="ref-for-concept-url-origin③">origin</a>,
 throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
      <li data-md>
       <p>Run a <a data-link-type="biblio" href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 3</cite></a> check with a <a href="https://w3c.github.io/webappsec-csp/#directive-connect-src">connect-src</a> directive on the URL
@@ -4789,6 +4801,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="b75a7d23">realm</span>
      <li><span class="dfn-paneled" id="9c4c1e66">relevant settings object</span>
      <li><span class="dfn-paneled" id="7393da89">same origin</span>
+     <li><span class="dfn-paneled" id="a23d12a9">scheme</span>
      <li><span class="dfn-paneled" id="c63519ed">top-level origin</span>
      <li><span class="dfn-paneled" id="bd736ec6">top-level traversable</span>
      <li><span class="dfn-paneled" id="30717154">top-level traversable <small>(for navigable)</small></span>
@@ -5491,7 +5504,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['1548047a'] = {"dfnID": "1548047a", "url": "https://drafts.csswg.org/css-color-5/#typedef-color", "dfnText": "<color>", "refSections": [{"refs": [{"id": "ref-for-typedef-color"}], "title": "3.2. The config file"}], "external": true};
 window.dfnpanelData['8b1a12a4'] = {"dfnID": "8b1a12a4", "url": "https://drafts.csswg.org/cssom-view-1/#set-up-browsing-context-features", "dfnText": "set up browsing context features", "refSections": [{"refs": [{"id": "ref-for-set-up-browsing-context-features"}], "title": "2.3.9. Helper algorithms"}], "external": true};
 window.dfnpanelData['85394472'] = {"dfnID": "85394472", "url": "https://dom.spec.whatwg.org/#document", "dfnText": "Document", "refSections": [{"refs": [{"id": "ref-for-document"}], "title": "4. Permissions Policy Integration"}], "external": true};
-window.dfnpanelData['c62cd7cf'] = {"dfnID": "c62cd7cf", "url": "https://dom.spec.whatwg.org/#concept-document-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-document-origin"}, {"id": "ref-for-concept-document-origin\u2460"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-document-origin\u2461"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-concept-document-origin\u2462"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-document-origin\u2463"}], "title": "2.3.7. Fetch an identity assertion"}, {"refs": [{"id": "ref-for-concept-document-origin\u2464"}], "title": "2.3.8. Request permission to sign-up"}, {"refs": [{"id": "ref-for-concept-document-origin\u2465"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
+window.dfnpanelData['c62cd7cf'] = {"dfnID": "c62cd7cf", "url": "https://dom.spec.whatwg.org/#concept-document-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-document-origin"}, {"id": "ref-for-concept-document-origin\u2460"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-document-origin\u2461"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-concept-document-origin\u2462"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-document-origin\u2463"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-concept-document-origin\u2464"}], "title": "2.3.7. Fetch an identity assertion"}, {"refs": [{"id": "ref-for-concept-document-origin\u2465"}], "title": "2.3.8. Request permission to sign-up"}, {"refs": [{"id": "ref-for-concept-document-origin\u2466"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['60a270ef'] = {"dfnID": "60a270ef", "url": "https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slots", "dfnText": "internal method", "refSections": [{"refs": [{"id": "ref-for-sec-ordinary-object-internal-methods-and-internal-slots"}, {"id": "ref-for-sec-ordinary-object-internal-methods-and-internal-slots\u2460"}], "title": "2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}, {"refs": [{"id": "ref-for-sec-ordinary-object-internal-methods-and-internal-slots\u2461"}], "title": "4. Permissions Policy Integration"}], "external": true};
 window.dfnpanelData['0303e8e5'] = {"dfnID": "0303e8e5", "url": "https://encoding.spec.whatwg.org/#utf-8-encode", "dfnText": "utf-8 encode", "refSections": [{"refs": [{"id": "ref-for-utf-8-encode"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-utf-8-encode\u2460"}], "title": "2.3.7. Fetch an identity assertion"}], "external": true};
 window.dfnpanelData['8e9945a0'] = {"dfnID": "8e9945a0", "url": "https://fetch.spec.whatwg.org/#concept-request-body", "dfnText": "body", "refSections": [{"refs": [{"id": "ref-for-concept-request-body"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-request-body\u2460"}], "title": "2.3.7. Fetch an identity assertion"}], "external": true};
@@ -5528,7 +5541,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['a4f8c442'] = {"dfnID": "a4f8c442", "url": "https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-dest", "dfnText": "sec-fetch-dest", "refSections": [{"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest"}], "title": "3.1. The Well-Known File"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2460"}], "title": "3.2. The config file"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2461"}], "title": "3.3. Accounts list endpoint"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2462"}], "title": "3.4. Client Metadata"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2463"}], "title": "3.5. Identity assertion endpoint"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2464"}], "title": "3.6. Disconnect endpoint"}, {"refs": [{"id": "ref-for-http-headerdef-sec-fetch-dest\u2465"}], "title": "6.2. Sec-Fetch-Dest Header"}], "external": true};
 window.dfnpanelData['be0c27b2'] = {"dfnID": "be0c27b2", "url": "https://html.spec.whatwg.org/multipage/system-state.html#navigator", "dfnText": "Navigator", "refSections": [{"refs": [{"id": "ref-for-navigator"}], "title": "2.1.3. JavaScript API"}], "external": true};
 window.dfnpanelData['3610bd67'] = {"dfnID": "3610bd67", "url": "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use", "dfnText": "allowed to use", "refSections": [{"refs": [{"id": "ref-for-allowed-to-use"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2460"}], "title": "2.4. The IdentityProvider Interface"}, {"refs": [{"id": "ref-for-allowed-to-use\u2461"}], "title": "4. Permissions Policy Integration"}], "external": true};
-window.dfnpanelData['3349d69f'] = {"dfnID": "3349d69f", "url": "https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window", "dfnText": "associated document", "refSections": [{"refs": [{"id": "ref-for-concept-document-window"}, {"id": "ref-for-concept-document-window\u2460"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-document-window\u2461"}, {"id": "ref-for-concept-document-window\u2462"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-concept-document-window\u2463"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-document-window\u2464"}], "title": "2.3.7. Fetch an identity assertion"}, {"refs": [{"id": "ref-for-concept-document-window\u2465"}], "title": "2.3.8. Request permission to sign-up"}, {"refs": [{"id": "ref-for-concept-document-window\u2466"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
+window.dfnpanelData['3349d69f'] = {"dfnID": "3349d69f", "url": "https://html.spec.whatwg.org/multipage/nav-history-apis.html#concept-document-window", "dfnText": "associated document", "refSections": [{"refs": [{"id": "ref-for-concept-document-window"}, {"id": "ref-for-concept-document-window\u2460"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-document-window\u2461"}, {"id": "ref-for-concept-document-window\u2462"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-concept-document-window\u2463"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-document-window\u2464"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-concept-document-window\u2465"}], "title": "2.3.7. Fetch an identity assertion"}, {"refs": [{"id": "ref-for-concept-document-window\u2466"}], "title": "2.3.8. Request permission to sign-up"}, {"refs": [{"id": "ref-for-concept-document-window\u2467"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['97c7a5d2'] = {"dfnID": "97c7a5d2", "url": "https://html.spec.whatwg.org/multipage/document-sequences.html#create-a-fresh-top-level-traversable", "dfnText": "create a fresh top-level traversable", "refSections": [{"refs": [{"id": "ref-for-create-a-fresh-top-level-traversable"}], "title": "2.3.9. Helper algorithms"}], "external": true};
 window.dfnpanelData['ce3d2bbb'] = {"dfnID": "ce3d2bbb", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object", "dfnText": "current global object", "refSections": [{"refs": [{"id": "ref-for-current-global-object"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-current-global-object\u2460"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['12b8dfc0'] = {"dfnID": "12b8dfc0", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object", "dfnText": "current settings object", "refSections": [{"refs": [{"id": "ref-for-current-settings-object"}, {"id": "ref-for-current-settings-object\u2460"}], "title": "2.1.3. JavaScript API"}, {"refs": [{"id": "ref-for-current-settings-object\u2461"}], "title": "4. Permissions Policy Integration"}], "external": true};
@@ -5537,7 +5550,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['a72449dd'] = {"dfnID": "a72449dd", "url": "https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel", "dfnText": "in parallel", "refSections": [{"refs": [{"id": "ref-for-in-parallel"}, {"id": "ref-for-in-parallel\u2460"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-in-parallel\u2461"}], "title": "2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}, {"refs": [{"id": "ref-for-in-parallel\u2462"}], "title": "2.3.4. Create an IdentityCredential"}, {"refs": [{"id": "ref-for-in-parallel\u2463"}], "title": "2.3.8. Request permission to sign-up"}, {"refs": [{"id": "ref-for-in-parallel\u2464"}, {"id": "ref-for-in-parallel\u2465"}, {"id": "ref-for-in-parallel\u2466"}], "title": "2.3.9. Helper algorithms"}, {"refs": [{"id": "ref-for-in-parallel\u2467"}], "title": "2.4. The IdentityProvider Interface"}, {"refs": [{"id": "ref-for-in-parallel\u2468"}], "title": "4. Permissions Policy Integration"}], "external": true};
 window.dfnpanelData['228be966'] = {"dfnID": "228be966", "url": "https://html.spec.whatwg.org/multipage/nav-history-apis.html#window-navigable", "dfnText": "navigable", "refSections": [{"refs": [{"id": "ref-for-window-navigable"}, {"id": "ref-for-window-navigable\u2460"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['b6ae4501'] = {"dfnID": "b6ae4501", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#networking-task-source", "dfnText": "networking task source", "refSections": [{"refs": [{"id": "ref-for-networking-task-source"}, {"id": "ref-for-networking-task-source\u2460"}], "title": "2.3.9. Helper algorithms"}], "external": true};
-window.dfnpanelData['b01b1359'] = {"dfnID": "b01b1359", "url": "https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque", "dfnText": "opaque origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin-opaque"}, {"id": "ref-for-concept-origin-opaque\u2460"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2461"}, {"id": "ref-for-concept-origin-opaque\u2462"}], "title": "2.3.6. Fetch the accounts list"}], "external": true};
+window.dfnpanelData['b01b1359'] = {"dfnID": "b01b1359", "url": "https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque", "dfnText": "opaque origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin-opaque"}, {"id": "ref-for-concept-origin-opaque\u2460"}, {"id": "ref-for-concept-origin-opaque\u2461"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2462"}, {"id": "ref-for-concept-origin-opaque\u2463"}], "title": "2.3.6. Fetch the accounts list"}], "external": true};
 window.dfnpanelData['086e3aff'] = {"dfnID": "086e3aff", "url": "https://html.spec.whatwg.org/multipage/browsers.html#concept-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin"}, {"id": "ref-for-concept-origin\u2460"}, {"id": "ref-for-concept-origin\u2461"}], "title": "2.1.1. Login Status Map"}, {"refs": [{"id": "ref-for-concept-origin\u2462"}], "title": "2.1.2. HTTP header API"}, {"refs": [{"id": "ref-for-concept-origin\u2463"}, {"id": "ref-for-concept-origin\u2464"}, {"id": "ref-for-concept-origin\u2465"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-origin\u2466"}, {"id": "ref-for-concept-origin\u2467"}, {"id": "ref-for-concept-origin\u2468"}, {"id": "ref-for-concept-origin\u2460\u24ea"}], "title": "2.3.4. Create an IdentityCredential"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2460"}], "title": "2.3.9. Helper algorithms"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2461"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['43ac8374'] = {"dfnID": "43ac8374", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin", "dfnText": "origin (for environment settings object)", "refSections": [{"refs": [{"id": "ref-for-concept-settings-object-origin"}], "title": "2.1.3. JavaScript API"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2460"}], "title": "2.1.4. Clearing the Login Status Map data"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2461"}], "title": "2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}], "external": true};
 window.dfnpanelData['a41102eb'] = {"dfnID": "a41102eb", "url": "https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy", "dfnText": "permissions policy", "refSections": [{"refs": [{"id": "ref-for-concept-document-permissions-policy"}], "title": "2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2460"}], "title": "4. Permissions Policy Integration"}], "external": true};
@@ -5545,6 +5558,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['b75a7d23'] = {"dfnID": "b75a7d23", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-global-object-realm", "dfnText": "realm", "refSections": [{"refs": [{"id": "ref-for-concept-global-object-realm"}], "title": "2.3.7. Fetch an identity assertion"}], "external": true};
 window.dfnpanelData['9c4c1e66'] = {"dfnID": "9c4c1e66", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object", "dfnText": "relevant settings object", "refSections": [{"refs": [{"id": "ref-for-relevant-settings-object"}], "title": "2.3.3. The [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) internal method"}], "external": true};
 window.dfnpanelData['7393da89'] = {"dfnID": "7393da89", "url": "https://html.spec.whatwg.org/multipage/browsers.html#same-origin", "dfnText": "same origin", "refSections": [{"refs": [{"id": "ref-for-same-origin"}], "title": "2.1.2. HTTP header API"}, {"refs": [{"id": "ref-for-same-origin\u2460"}], "title": "2.1.4. Clearing the Login Status Map data"}, {"refs": [{"id": "ref-for-same-origin\u2461"}], "title": "2.3.9. Helper algorithms"}, {"refs": [{"id": "ref-for-same-origin\u2462"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
+window.dfnpanelData['a23d12a9'] = {"dfnID": "a23d12a9", "url": "https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-scheme", "dfnText": "scheme", "refSections": [{"refs": [{"id": "ref-for-concept-origin-scheme"}], "title": "2.3.5. Fetch the config file"}], "external": true};
 window.dfnpanelData['c63519ed'] = {"dfnID": "c63519ed", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin", "dfnText": "top-level origin", "refSections": [{"refs": [{"id": "ref-for-concept-environment-top-level-origin"}], "title": "2.1.4. Clearing the Login Status Map data"}], "external": true};
 window.dfnpanelData['bd736ec6'] = {"dfnID": "bd736ec6", "url": "https://html.spec.whatwg.org/multipage/document-sequences.html#top-level-traversable", "dfnText": "top-level traversable", "refSections": [{"refs": [{"id": "ref-for-top-level-traversable"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['30717154'] = {"dfnID": "30717154", "url": "https://html.spec.whatwg.org/multipage/document-sequences.html#nav-top", "dfnText": "top-level traversable (for navigable)", "refSections": [{"refs": [{"id": "ref-for-nav-top"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
@@ -5575,12 +5589,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['cc890cc1'] = {"dfnID": "cc890cc1", "url": "https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature", "dfnText": "policy-controlled feature", "refSections": [{"refs": [{"id": "ref-for-policy-controlled-feature"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-policy-controlled-feature\u2460"}], "title": "2.4. The IdentityProvider Interface"}, {"refs": [{"id": "ref-for-policy-controlled-feature\u2461"}], "title": "4. Permissions Policy Integration"}], "external": true};
 window.dfnpanelData['96dabee7'] = {"dfnID": "96dabee7", "url": "https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin", "dfnText": "potentially trustworthy origin", "refSections": [{"refs": [{"id": "ref-for-potentially-trustworthy-origin"}], "title": "2.3.1. The disconnect method"}], "external": true};
 window.dfnpanelData['9c5d9c4d'] = {"dfnID": "9c5d9c4d", "url": "https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-url", "dfnText": "potentially trustworthy url", "refSections": [{"refs": [{"id": "ref-for-potentially-trustworthy-url"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-potentially-trustworthy-url\u2460"}], "title": "2.3.9. Helper algorithms"}], "external": true};
-window.dfnpanelData['b85ee3be'] = {"dfnID": "b85ee3be", "url": "https://url.spec.whatwg.org/#concept-url-host", "dfnText": "host", "refSections": [{"refs": [{"id": "ref-for-concept-url-host"}, {"id": "ref-for-concept-url-host\u2460"}], "title": "2.3.5. Fetch the config file"}], "external": true};
+window.dfnpanelData['b85ee3be'] = {"dfnID": "b85ee3be", "url": "https://url.spec.whatwg.org/#concept-url-host", "dfnText": "host", "refSections": [{"refs": [{"id": "ref-for-concept-url-host"}, {"id": "ref-for-concept-url-host\u2460"}, {"id": "ref-for-concept-url-host\u2461"}], "title": "2.3.5. Fetch the config file"}], "external": true};
 window.dfnpanelData['959ad97b'] = {"dfnID": "959ad97b", "url": "https://url.spec.whatwg.org/#concept-url-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-url-origin"}, {"id": "ref-for-concept-url-origin\u2460"}], "title": "2.2. The connected accounts set"}, {"refs": [{"id": "ref-for-concept-url-origin\u2461"}], "title": "2.3.1. The disconnect method"}, {"refs": [{"id": "ref-for-concept-url-origin\u2462"}], "title": "2.4. The IdentityProvider Interface"}], "external": true};
 window.dfnpanelData['c0868016'] = {"dfnID": "c0868016", "url": "https://url.spec.whatwg.org/#concept-url-path", "dfnText": "path", "refSections": [{"refs": [{"id": "ref-for-concept-url-path"}], "title": "2.3.5. Fetch the config file"}], "external": true};
 window.dfnpanelData['3ab2ec8b'] = {"dfnID": "3ab2ec8b", "url": "https://url.spec.whatwg.org/#concept-url-query", "dfnText": "query", "refSections": [{"refs": [{"id": "ref-for-concept-url-query"}, {"id": "ref-for-concept-url-query\u2460"}], "title": "2.3.9. Helper algorithms"}], "external": true};
-window.dfnpanelData['bc9d7803'] = {"dfnID": "bc9d7803", "url": "https://url.spec.whatwg.org/#host-registrable-domain", "dfnText": "registrable domain", "refSections": [{"refs": [{"id": "ref-for-host-registrable-domain"}], "title": "2.3.5. Fetch the config file"}], "external": true};
-window.dfnpanelData['3a711be7'] = {"dfnID": "3a711be7", "url": "https://url.spec.whatwg.org/#concept-url-scheme", "dfnText": "scheme", "refSections": [{"refs": [{"id": "ref-for-concept-url-scheme"}, {"id": "ref-for-concept-url-scheme\u2460"}], "title": "2.3.5. Fetch the config file"}], "external": true};
+window.dfnpanelData['bc9d7803'] = {"dfnID": "bc9d7803", "url": "https://url.spec.whatwg.org/#host-registrable-domain", "dfnText": "registrable domain", "refSections": [{"refs": [{"id": "ref-for-host-registrable-domain"}, {"id": "ref-for-host-registrable-domain\u2460"}], "title": "2.3.5. Fetch the config file"}], "external": true};
+window.dfnpanelData['3a711be7'] = {"dfnID": "3a711be7", "url": "https://url.spec.whatwg.org/#concept-url-scheme", "dfnText": "scheme", "refSections": [{"refs": [{"id": "ref-for-concept-url-scheme"}, {"id": "ref-for-concept-url-scheme\u2460"}, {"id": "ref-for-concept-url-scheme\u2461"}], "title": "2.3.5. Fetch the config file"}], "external": true};
 window.dfnpanelData['dcffbccd'] = {"dfnID": "dcffbccd", "url": "https://url.spec.whatwg.org/#concept-url", "dfnText": "url", "refSections": [{"refs": [{"id": "ref-for-concept-url"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-url\u2460"}], "title": "2.3.5. Fetch the config file"}, {"refs": [{"id": "ref-for-concept-url\u2461"}, {"id": "ref-for-concept-url\u2462"}], "title": "2.3.9. Helper algorithms"}], "external": true};
 window.dfnpanelData['ca3ca4ae'] = {"dfnID": "ca3ca4ae", "url": "https://url.spec.whatwg.org/#concept-url-parser", "dfnText": "url parser", "refSections": [{"refs": [{"id": "ref-for-concept-url-parser"}, {"id": "ref-for-concept-url-parser\u2460"}, {"id": "ref-for-concept-url-parser\u2461"}], "title": "2.3.9. Helper algorithms"}], "external": true};
 window.dfnpanelData['d7edb843'] = {"dfnID": "d7edb843", "url": "https://url.spec.whatwg.org/#concept-urlencoded-serializer", "dfnText": "urlencoded serializer", "refSections": [{"refs": [{"id": "ref-for-concept-urlencoded-serializer"}], "title": "2.3.1.1. Disconnect request"}, {"refs": [{"id": "ref-for-concept-urlencoded-serializer\u2460"}], "title": "2.3.7. Fetch an identity assertion"}, {"refs": [{"id": "ref-for-concept-urlencoded-serializer\u2461"}], "title": "2.3.9. Helper algorithms"}], "external": true};