[wg/webappsec] Web Application Security Working Group Charter

[simoneonofri]

New charter proposal, reviewers please take note.

Charter Review

Web Application Security Working Group Charter

charter update: w3c/charter-drafts#855

diff from charter template

Expected end of charter refinement phase: 1 August 2026

diff from previous charter

chair dashboard

What kind of charter is this?

• Existing WG recharter

Horizontal Reviews: apply the GitHub label "Horizontal review requested" to request reviews for accessibility (a11y), internationalization (i18n), privacy, security, and TAG. Also add a card for this issue to the Strategy Funnel.

Substantive changes

• Updated the charter to the current charter template, including publication and patent-policy information.
• Expanded the Web Cryptography scope from maintenance to evolution and maintenance, and added coordination with relevant IETF work, including the Crypto Forum Research Group.
• Added Web Cryptography Level 2 and Device Bound Session Credentials as normative deliverables.
• Added Device Bound Session Credentials for Single Sign-On as a tentative deliverable.
• Added collaboration with the Security Interest Group on horizontal security review and the Web Security Model.

Known or potential areas of concern

Where would charter proponents like to see issues raised? (this strategy funnel issue)

Anything else we should think about as we review?

@dveditz @mikewest

[lucasrsant]

Hi Simone, nice to meet you. plehegar suggested me to reach out to you.

We are working on extending Device Bound Session Credentials for cross-origin authentication contexts (SSO), and wanted to bring this to your attention as part of the "Tentative Deliverables" section.

The explainer is published in my personal repo but the intention is to move it to the WICG repository, and eventually to the WebAppSec working group.

[simoneonofri]

@lucasrsant thank you, you can add a PR to https://github.com/w3c/charter-drafts/blob/gh-pages/2026/charter-wg-webappsec-2026.html

Then if @dveditz, @mikewest agrees, and sending an message to the WG

[npdoty]

Substantive Changes: N/A

I don't think that's correct, but it does make it especially hard to review or understand what's being asked. If there aren't any changes, then I'm not sure it needs a recharter. Or if you're still coming up with the changes, then I'm not sure you want horizontal review yet, right?

[himorin]

• seems mis-used charter update tool? does current on correctly saved from tooling?
• (for reviewer) diff from charter template link was wrong
• see many diff on normative deliverables, but no change recorded in history table. is there no change?

[himorin]

No comment or request from i18n