EVP rough edges

[Levi Schuck]

Hi there, I just got through implementing this for a brief mention in my presentation that I'll do at DEF CON (as an alternative to email verification with OTPs, please please make this happen! :) ). I ran into a few rough edges that should hopefully help EVP's development. 

The spec ( https://www.ietf.org/archive/id/draft-hardt-email-verification-00.html#section-4.2-2.2 ) section 4.2. HTTP Request Verification says:
The issuer MUST verify the request headers:

Content-Type is application/json
Sec-Fetch-Dest is email-verification
Signature-Input is present
Signature is present
Signature-Key is present with sig=hwk scheme

However... Chrome is sending "emailverification" instead of "email-verification" for "Sec-Fetch-Dest" and your demo (at https://github.com/rowan-m/rowan-fyi/blob/main/src/pages/made/email-verification/index.astro ) does not check these things at all.

"emailverification" seems to be coming from https://github.com/chromium/chromium/blob/150.0.7871.129/services/network/public/cpp/request_destination.cc#L43-L50 and it looks like several of those strings have no hyphens or casing. 

Another issue, already solved in https://github.com/chromium/chromium/commit/46b2fe3a293f39f0a99ffa6c99a6c1ba47379a9b , is how nonce was being pulled through getAttribute instead which broke due to the whole nonce internal slot hiding behavior when script nonces are a thing. My temp workaround is to patch it back in through a data-attribute in js on load for now. 

I'm using chrome 150.0.7871.129 and I managed to produce a crash while clicking on the auto complete option while having the histogram tab up for debugging reasons

Crash from Sunday, July 19, 2026 at 8:48:04 PM
Status: Uploaded
Uploaded Crash Report ID: ae257880fd62e492
Upload Time: Sunday, July 19, 2026 at 9:06:26 PM

The chrome implementation doesn't match the spec for audience / issuer 

https://github.com/chromium/chromium/blob/4afd4cb48b6f5ab7a45205f5e7ca0a4d276acffe/content/browser/webid/delegation/email_verification_request.cc#L98-L125

payload.aud = issuer.Serialize();

This results in an https://issuer.example origin while issuer in https://github.com/WICG/email-verification seems to be the domain instead given the expected interpolation: https://{issuer}/.well-known/email-verification
and the txt record being without the protocol _email-verification.email-domain.example   TXT   iss=issuer.example

Another implementation difference from the spec https://www.ietf.org/archive/id/draft-hardt-email-verification-00.html#section-5.1.2-2.1 the example shows "iss": "issuer.example", but the implementation in https://github.com/chromium/chromium/blob/4afd4cb48b6f5ab7a45205f5e7ca0a4d276acffe/content/browser/webid/delegation/evt_verifier.cc#L49-L58 is once again comparing against the origin instead:
if (payload.iss != issuer.Serialize()) {
    return base::unexpected(Result::kSdJwtInvalidIssuer);
}

The KB-JWT uses origin on both sides for "aud", so that one seems fine?

There's a note in the spec about form url encoded being deprecated and to use json instead https://www.ietf.org/archive/id/draft-hardt-email-verification-00.html#section-2.4 
Chrome 150.0.7871.129 is still sending forms. :( 
https://github.com/chromium/chromium/blob/e69b30bba288603e514cffb4c79c359cac68e923/content/browser/webid/delegation/email_verification_request.cc#L442
      result.issuance_endpoint, "request_token=" + request_token.value(),
and

https://github.com/chromium/chromium/blob/150.0.7871.129/content/browser/webid/delegation/email_verifier_network_request_manager.cc#L204-L215

I hope this is helpful and I hope this feature matures. 

Best wishes,

Levi

[Levi Schuck]

I also do not have permissions to open issues on EVP https://issues.chromium.org/u/1/issues/new?component=2129277&template=2355861
Feel free to copy my feedback in there. 

[Nicolás Peña Moreno]

Hey thanks for the feedback! It's weird that you can't file an issue in that component, it should ideally be open to anyone to file a bug. For now, I filed crbug.com/536579237 for you.

--
You received this message because you are subscribed to the Google Groups "evp-announce" group.
To unsubscribe from this group and stop receiving emails from it, send an email to evp-announce...@chromium.org.
To view this discussion, visit https://groups.google.com/a/chromium.org/d/msgid/evp-announce/a2da5fc7-5280-4360-abb7-86eef782206fn%40chromium.org.
For more options, visit https://groups.google.com/a/chromium.org/d/optout.