change(webauthn): WebAuthn Level 3 is a W3C Recommendation - #206
Draft
jdevalk wants to merge 1 commit into
Draft
Conversation
WebAuthn Level 3 — the edition that added Related Origin Requests, and so the reason /.well-known/webauthn exists at all — reached W3C Recommendation on 25 August 2026. The page cited it as a bare /TR/ URL and called ROR "in the W3C standard", which was true but vague while Level 3 was still a working draft. Named the source as a Recommendation and said so in the prose. No date is pinned in the source title: ARIA in HTML (#177) showed that naming the current edition's date rots within weeks once a REC starts being amended. "Reached Recommendation in August 2026" is a fact that does not move. Status stays `optional`. ROR still only applies to sites running passkeys across more than one origin; a Recommendation does not widen who needs the file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying specification-website with
|
| Latest commit: |
517fa2c
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://45c9fdfb.specification-website.pages.dev |
| Branch Preview URL: | https://change-webauthn-l3-rec-2026.specification-website.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
/.well-known/webauthnnow describes WebAuthn Level 3 as a W3C Recommendation rather than as an unqualified "W3C standard":## What it is: ROR is "a feature added in WebAuthn Level 3, which reached W3C Recommendation in August 2026".## Why it matters: "ROR is in the W3C Recommendation" (was "in the W3C standard").updatedbumped.Why now
Web Authentication: An API for accessing Public Key Credentials — Level 3 was published as a W3C Recommendation on 25 August 2026. Level 3 is the edition that introduced Related Origin Requests, which is the entire reason this well-known URI exists — so the page's central citation moved from a draft to a finished standard.
No date is pinned in the source title deliberately. #177 ("ARIA in HTML is an amended REC, not an April 2026 one") showed that naming the Recommendation date rots within weeks once W3C starts republishing amended editions. "Reached Recommendation in August 2026" is a fact that does not move.
Primary source
Status
Unchanged —
optional. A Recommendation does not widen who needs the file. Related Origin Requests still only apply to sites running passkeys across more than one origin; a single-domain site has nothing to list and should not publish it.Changelog
No entry. This is citation accuracy plus a two-word prose correction, not a substantive rewrite — same call as #175/#177. Say the word if you'd rather it landed as a
changedentry.🤖 Generated with Claude Code