1448408 - Web Authentication - Don't listen to visibility events

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/they)]

The SoftU2F project [1] provides an authenticator in-software which works using system prompts instead of external interactions. Since Bug 1409202, WebAuthn aborts if Firefox goes into the background at all. Since going into the background is mandatory for SoftU2F, interacting with SoftU2F always causes an AbortError, rendering it unusuable.

More OS-integrated mechanisms, like Windows Hello, may or may not have the same problem.

We might want to be a little less strict about foreground-only?


[1] https://github.com/github/SoftU2F

Comment 1

[Tim Taubert [:ttaubert] (inactive)]

(In reply to J.C. Jones [:jcj] from comment #0)
> We might want to be a little less strict about foreground-only?

I just check Chrome Canary and it looks like there are no checks at all. I can launch a WebAuthn request from a background tab or a minimized window. Active requests aren't aborted when switching tabs or windows.

We could possibly do something in between, i.e. allow requests to start only when the tab is selected in the active window, but don't cancel when switching tabs. Or don't cancel when switching windows?

Although that still wouldn't help with bug 1445242...

Comment 2

[Ben Toews]

Chrome does have some requirements. I think if the response from the security key comes while the window doesn't have focus it is ignored. Soft U2F tries to give focus back very quickly to work with this behavior.

Comment 3

[Tim Taubert [:ttaubert] (inactive)]

(In reply to Ben Toews from comment #2)
> Chrome does have some requirements. I think if the response from the
> security key comes while the window doesn't have focus it is ignored.

This doesn't reproduce with Canary at least. I can initiate and complete requests with Chrome in the background.

Comment 4

[Armin Ronacher]

Is there anything that can be done to work around this? I was trying to switch to Firefox today from Chrome but SoftU2F does not work with it due to this bug and there has not been activity here for a very long time.

Comment 5

[J.C. Jones [:jcj] (he/they)]

I'll be addressing this and most of the other webauthn bugs currently on-file in Q1 2019. Hopefully January, but TBD.

Comment 7

[J.C. Jones [:jcj] (he/they)]

The published recommendation of L1 for WebAuthn changed the visibility/focus listening behaviors to a SHOULD [1], and Chromium, for these sorts of reasons, opted to not interrupt on tabswitch/visibility change. Let's do the same thing.

[1] https://www.w3.org/TR/webauthn-1/#abortoperation

Comment 8

[Ben Toews]

Great news! I hadn't realized that Soft U2F was working with Chrome now for WebAuthn. Great news also to hear that it will work with FF.

Comment 9

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1448408 - Web Authentication - Don't listen to visibility events

The published recommendation of L1 for WebAuthn changed the visibility/focus
listening behaviors to a SHOULD [1], and Chromium, for reasons like our SoftU2F
bug [0], opted to not interrupt on tabswitch/visibility change.

Let's do the same thing.

This removes the abort visibility mechanism entirely, test and all.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1448408#c0
[1] https://www.w3.org/TR/webauthn-1/#abortoperation

Comment 10

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1448408 - Web Authentication - Don't immediately abort on visibility events

The published recommendation of L1 for WebAuthn changed the visibility/focus
listening behaviors to a SHOULD [1], and Chromium, for reasons like our SoftU2F
bug [0], opted to not interrupt on tabswitch/visibility change.

Let's do the same thing.

This changes the visibility mechanism to set a flag on an ongoing transaction,
and then, upon multiple calls to the FIDO/U2F functions, only aborts if
visibility had changed. Otherwise, subsequent callers return early.

This is harder to explain than it is really to use as a user. I think. At least,
my testing feels natural when I'm working within two windows, both potentially
prompting WebAuthn.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1448408#c0
[1] https://www.w3.org/TR/webauthn-1/#abortoperation

Update FIDO U2F API to also take the stance of visibility events being
not-bad.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f7937d3264db
Web Authentication - Don't immediately abort on visibility events r=keeler

Comment 12

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/f7937d3264db