1435527 - Web Authentication - Run to Timeout from navigator.credentials.get when PublicKeyCredentialRequestOptions.allowCredentials is empty

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P1)

Description

[Yoshikazu Nojima]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20180203100135

Steps to reproduce:

This bug is related to WebAuthn.
https://bugzilla.mozilla.org/show_bug.cgi?id=1294514

# Setup

create a credential by calling `navigator.credentials.create`

# Test

call `navigator.credentials.get` with PublicKeyCredentialRequestOptions whose allowCredentials is empty.



Actual results:

DOMException with message "The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission." is thrown.

(It is confirmed that an assertion is returned when putting item with a crednetialId to allowCredentials.)


Expected results:

assertion should be returned

Comment 1

[J.C. Jones [:jcj] (he/they)]

Since we don't support any authenticators yet that can operate without a passed-in AllowCredential, we can't return an assertion. (U2F devices -- all we support -- have no internal storage)

That said, per 5.1.4 [1] step 19, we should return a NotAllowedError at the end of the timeout, not immediately.

You can reproduce this easily with:

navigator.credentials.get({publicKey: {
  timeout: 3000,
  challenge: new Uint8Array(),
  allowCredentials: [],
}})
.catch( (e) => {console.log("Should be NotAllowedError after timeout. Error = ", e.name);} );


[1] https://w3c.github.io/webauthn/#discover-from-external-source

Comment 2

[Phabricator Automation]

Attachment: Bug 1435527 - Run to Timeout from navigator.credentials.get when PublicKeyCredentialRequestOptions.allowCredentials is empty r=jcj

Comment 3

[Phabricator Automation]

Comment on attachment 8949112 [details]
Bug 1435527 - Run to Timeout from navigator.credentials.get when PublicKeyCredentialRequestOptions.allowCredentials is empty r=jcj

J.C. Jones [:jcj] has approved the revision.

https://phabricator.services.mozilla.com/D559

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e2818fa57916
Run to timeout from navigator.credentials.get() when PublicKeyCredentialRequestOptions.allowCredentials is empty r=jcj

Comment 5

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ec6cd52c3fde
Backed out changeset e2818fa57916 mochitest leakcheck failures, a=backout on a CLOSED TREE

Comment 6

[Andrei Ciure[:aciure]]

Backed out changeset e2818fa57916 (bug 1435527) mochitest leakcheck failures, a=backout on a CLOSED TREE 

Push that caused the failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=e2818fa5791629800811b280926b834270b26958

recent log failure: https://treeherder.mozilla.org/logviewer.html#?job_id=160942897&repo=mozilla-inbound&lineNumber=5490

backout: https://hg.mozilla.org/integration/mozilla-inbound/rev/ec6cd52c3fde993d8672938c135ea7c81c680c0a

Comment 7

[Tim Taubert [:ttaubert] (inactive)]

Turns out that using a global `let credm = navigator.credentials` together with the new `add_task()` routines somehow leaks... Going to fix up the test a bit.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c4034229cf62
Run to timeout from navigator.credentials.get() when PublicKeyCredentialRequestOptions.allowCredentials is empty r=jcj

Comment 9

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/c4034229cf62

Comment 10

[Yoshikazu Nojima]

Thank you for clarification, but I got another DOMException named "UnknownError" from `navigator.credentials.get` wih 60.0a1 (2018-02-09).

DOMException
 name: UnknownError
 message: The operation failed for an unknown transient reason

Demo site to reproduce:
https://ynojima.github.io/webauthn-exp/

My environment:
  OS: Windows 10 64bit
  Browser: Firefox Nigtly 60.0a1 (2018-02-09)
  FIDO U2FKey : Yubico FIDO U2F Security Key

Comment 11

[Tim Taubert [:ttaubert] (inactive)]

Please don't reopen bugs. File a new one for new issues.

Comment 12

[Tim Taubert [:ttaubert] (inactive)]

Filed bug 1437487.