1382893 - WebAuthn RP-IDs should enforce HTTPS and be permissive for alternative TCP ports

Status: RESOLVED WONTFIX

(Core :: DOM: Device Interfaces, defect, P1)

Description

[J.C. Jones [:jcj] (he/they)]

The WebAuthn Relying Party domain strings are defined as being restricted to https (enforced by [SecureContext]), meeting the "Is Registrable Domain Suffix Of Or Equal To" algorithm (already implemented), and being generic to all TCP ports on a host.

The last should be enforced by the nsIURI parsing code in use, but is not covered by tests. Add tests and make sure that's working properly.

[1] https://w3c.github.io/webauthn/#relying-party-identifier

Comment 1

[Andrew Overholt [:overholt]]

Are we planning to do this in 57?

Comment 2

[J.C. Jones [:jcj] (he/they)]

No. Updating to 'Future' as it's still undetermined what the schedule will be.

Comment 3

[Andrew Overholt [:overholt]]

Thanks. I've made a few other flag changes here to clarify the situation.

Comment 4

[J.C. Jones [:jcj] (he/they)]

I've made a website to test this: 

https://webauthn.bin.coffee:8443/

And, as expected, manual tests pass.

I've also produced a patch that adds an automated test, but it doesn't work as our mochitest webserver needs to support ports other than 443 for HTTPS. 

I'll attach the patch for posterity, but I think we can leave this without an automated test. The code path for this functionality runs through nsURI, and that is unlikely to change substantially enough to cause a regression.

Comment 5

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1382893 - Add a WebAuthn test to confirm RP ID is not port-sensitive

This patch adds a test to perform a Web Authentication operation from a server
on port 8443 using a port-less RP ID. The operation should succeed.

This patch doesn't currently work on OSX because no server spins up on 8443.

There is a manual test available at https://webauthn.bin.coffee:8443/

Review commit: https://reviewboard.mozilla.org/r/211134/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/211134/

Comment 6

[J.C. Jones [:jcj] (he/they)]

Marking this wontfix for now, pending further discussions.