This demo tests the use of a 'pure' (i.e., not payment-enabled) WebAuthn
credential in a first-party scenario. This will not work in a naive
browser-cache implementation of SPC, but will work with availability
and use of proper OS-level credential store APIs. To test the integration:
In the iframe, click on 'Enroll Credential'
This will open a pop-up* to https://spc-1p-payment-demo.glitch.me/enroll.html
Complete the credential enrollment, and the pop-up will close
Outside of the iframe, click on 'Trigger third-party SPC'.
This should fail, because the credential isn't enabled for third-party payment
Inside of the iframe, click on 'Trigger first-party SPC'. This should succeed.
* WebAuthn issue #1656
tracks allowing us to do this without a new tab!