Skip to main content

Browser extension・WordPress plugin v0.5.0

Release Information​

This version includes changes aimed at improving security, internationalization, and addressing technical debt.

Extensions​

Internationalization​

Site Profile's media and sites (formerly credential) now support arrays and are internationalized.

How it works: credential is renamed to sites, and multiple languages ​​are stored as an array (if media is a single language, it is changed to the array ["<JWT>"]).

Before change:

{
  "originators": [
    {
      "core": "eyJ...",
      "annotations": ["eyJ..."], // Profile Annotation
      "media": "eyJ...", // Web Media Profile
    },
  ],
  "credential": "eyJ...", // Website Profile
}

After change:

{
  "originators": [
    {
      "core": "eyJ...",
      "annotations": [
        "eyJ...", // {"@language": "en-US"} Profile Annotation
        "eyJ...", // {"@language": "ja-JP"} Profile Annotation
      ],
      "media": [
        "eyJ...", // {"@language": "en-US"} Web Media Profile
        "eyJ...", // {"@language": "ja-JP"} Web Media Profile
      ],
    },
  ],
  "sites": [
    "eyJ...", // {"@language": "en-US"} Website Profile
    "eyJ...", // {"@language": "ja-JP"} Website Profile
  ],
}

The language is indicated by including @language in the @context of each VC. The extension automatically selects the appropriate profile based on the user's locale (navigator.language).

Pull Requests:

  • The media and sites fields in the Site Profile have been converted into arrays to support internationalization (#272)

Verification of digestSRI properties​

Image integrity verification (SRI) is now possible when referencing images.

Pull Requests:

  • Added image-based digestSRI verification functionality (#331)

Verification of ad destination​

It is now possible to verify the destination site of an ad link that clearly states its OP ID.

Pull Requests:

  • Implementation of OPID verification functionality and warning pages for ad destinations (#294)

Display of verification count​

The verification count is now displayed on the badge.

image

Pull Requests:

  • Implementation of a function to display the number of verifications per tab (#295)

WordPress Plugins​

Simplification of static pages for OIDC authentication​

A function to define short codes has been added to the theme, eliminating the need to manually create static pages that include authentication short codes.

Migration method :

  1. After updating the plugin, deactivate the plugin once in the WordPress admin panel, then re-enable it (this is necessary to flush the rewrite rules; failure to do so will result in a 404 error).
  2. In the CA Server's OIDC settings, change the callback URL from /cas-auth/ to /oidc-callback/ and update the authentication information.
  3. Delete the definitions for the old static page (cas-auth) and related short codes.

Pull Requests:

  • WordPress Plugin: Supports virtualization of static pages for OIDC authentication (#359)

Support for OAuth2 Client Credentials Grant​

Authentication using OAuth2 Client Credentials Grant has been added for "Easy Access". (Authentication information format: CCSP:***) (v0.4.3)

Pull Requests:

  • Support for CA Server Authentication (CCSP) in WordPress Plugins (#274)

Strengthening of the verification scope​

The HTML to be verified now includes the title %TITLE% by default.

How to handle :

Before change:

CSS Selector : .wp-block-post-content>*:not(.post-nav-links)

<!doctype html>
<body class="wp-block-post-content">
  %CONTENT%
</body>

After change:

CSS Selector : h1.wp-block-post-title, .wp-block-post-content>*:not(.post-nav-links)

<!doctype html>
<body>
  <h1 class="wp-block-post-title">%TITLE%</h1>
  <div class="wp-block-post-content">%CONTENT%</div>
</body>

Custom templates that do not include the %TITLE% placeholder will still be backward compatible (existing body verification will continue to work, but the title will simply not be included in the verification).

Pull Requests:

  • Include the title as the default verification target for Content Attestation in WordPress plugins (#340)
Details

Added​

  • Implemented OPID verification function and warning page for ad destinations (#294)
  • Added digestSRI verification function for images (#331)
  • Added error definitions for URLPattern format errors and Fetch failures in ad destination verification (#310)
  • Implemented a function to display the number of verifications per tab (#295)
  • Added a function to inject Content Scripts into existing tabs (#339)
  • Added display of issuer and validity period in verification results (#344)
  • Added a link to corresponding documentation from error codes (#320)
  • Display the content of unknown errors (#319)
  • Added a display for cases where CAS verification is successful but WMP does not exist (#323)
  • Display a warning mark for items that decoded successfully but did not proceed to verification (#326)
  • Added Certificate expiration date verification (#269)
  • Added a function to delete CAs in conjunction with unpublishing/deleting articles in WordPress plugins (#270)
  • WordPress Plugin support for CA Server Authentication (CCSP) (#274)
  • Include title as the default verification target for Content Attestation in WordPress plugins (#340)
  • WordPress plugin support for virtualization of static pages for OIDC authentication (#359)
  • Add signByServer to OPVC (#362)
  • Add corporateName property to JP-OrganizationExistenceCertificate schema (#297)
  • Display build mode (#315)
  • Add nested CA ads using iframes to demo pages (#260)

Changed​

  • [BREAKING] Requires digestSRI for URL reference images and performs verification processing before displaying them in the extension UI (#331)
  • [BREAKING] Converts media / sites in Site Profile into arrays to support internationalization (multilingual) (#272)
  • [BREAKING] Changes the name of sites from the old property name credential to sites at the same time as converting it to an array (#272)
  • [BREAKING] Renames OriginatorProfileSetItem to OriginatorProfile (#357)
  • [BREAKING] Removes deprecated models, errors, types, assets, and functions (#345)
  • [BREAKING] Migrates all schemas from JSON Schema to Zod (#343)
  • Changes so that overlays also follow CA filtering (#309)
  • If the number of applicable CAs is 0 - Changed the filter item to be hidden (#301)
  • Revamped the list display on the technical information screen (#305)
  • Utilized z.stringFormat() for AllowedOrigin / AllowedUrl validation (#355)
  • Modified the headline and description fields to be required in the WordPress plugin (#266)

Fixed​

  • Allow time zone offsets in Zod datetime validation (#356)
  • Improve code quality for ad destination verification feature (#361)
  • Correct case sensitivity of HtmlTargetIntegrity option in WordPress plugin (#273)
  • Modified to use flatMap for CA aggregation from all frames (#282)

Security​

  • Updated happy-dom to v20.8.9 (#364)
  • Updated DOMPurify to v3.3.2 (#334)

Pull Requests​

New Contributors​

Full Changelog: https://github.com/originator-profile/originator-profile/compare/v0.4.0...v0.5.0

Download​

Download from the Assets section below.

  • Extension: profile_web_extension-chromium-0.5.0.zip
  • Extension: profile_web_extension-firefox-desktop-0.5.0.zip
  • WordPress Plugin v0.5.0: wordpress-ca-manager.zip

Installation Instructions​