• @milliams
    link
    114 days ago

    Thanks, very interesting. I’m a bit confused about what this means:

    explicit credentials are unsuitable for server-rendered sites as they aren’t included in top-level navigation

    What does “top-level navigation” mean here?

    • @[email protected]
      link
      fedilink
      114 days ago

      ‘’’ Note: When I say “top-level” I am talking about the URL that you see in the address bar. So if you load fun-games.example in your URL bar and it makes a request to your-bank.example then fun-games.example is the top-level site. ‘’’ Meaning explicit creds won’t be sent. Even if fun-games knows how to send explicit creds, it can’t because fun-games does not have access to creds which stored for your-bank. Say suppose your-bank creds stored in local store. Since current URL is fun-games it can only access local storage of fun-games, not your-bank.