1551594 - Support HmacSecret webauthn extension

Status: VERIFIED FIXED

(Core :: DOM: Web Authentication, enhancement, P1)

Description

[Akshay Kumar]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3789.0 Safari/537.36 Edg/76.0.158.0

Steps to reproduce:

Go to https://webauthntest.azurewebsites.net/ and select extension during MakeCredential

Actual results:

Firefox webauthn implementation don't support MakeCredential CredProtect and Hmac-secret extensions. These are supported by Chrome/Edge.

Expected results:

Firefox webauthn implementation should support common extensions by other browsers for maximum compatibility.

Comment 1

[Akshay Kumar]

Attachment: Bug 1551594 - Support HmacSecret webauthn extension

Comment 2

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:

We'll want this in ESR68 for broad WebAuthn compatibility.

Comment 3

[Julien Cristau [:jcristau]]

Is this ready to land?

Comment 4

[J.C. Jones [:jcj] (he/they)]

It is now. :)

Comment 5

[J.C. Jones [:jcj] (he/they)]

Taking this on next week

Comment 6

[Julien Cristau [:jcristau]]

[Tracking Requested - why for this release]: see comment 2

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/10b3315ced42
Support HmacSecret webauthn extension r=keeler,smaug

Comment 8

[Arthur Iakab [arthur_iakab]]

https://hg.mozilla.org/mozilla-central/rev/10b3315ced42

Comment 9

[J.C. Jones [:jcj] (he/they)]

Release Note Request (optional, but appreciated)
[Why is this notable]: New extension webdevs can support when targetting CTAP2.
[Affects Firefox for Android]: No, only Windows 10 2019-04 or later.
[Suggested wording]: Added support for the Web Authentication HmacSecret extension via Windows Hello.
[Links (documentation, blog post, etc)]: Not planning one, but https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#sctn-hmac-secret-extension covers the extension

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Added to the Fx69 Beta release notes.

Comment 11

[J.C. Jones [:jcj] (he/they)]

Akshay,

Can you have your team verify this functionality for Firefox 69 (Beta)?

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Do we need to do something for 68.1esr here still?

Comment 13

[J.C. Jones [:jcj] (he/they)]

Comment on attachment 9064801 [details]
Bug 1551594 - Support HmacSecret webauthn extension

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This patch provides support for using Windows Hello (via WebAuthn) to log into Azure Active Directory enterprise domains, which is almost entirely an ESR population. It keeps Firefox in-sync with Edge for these users.
• User impact if declined: No AAD WebAuthn support until next ESR.
• Fix Landed on Version: 69
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It's very contained, only to Windows via Hello. However, it has no meaningful automated tests, however I tested the feature via https://webauthntest.azurewebsites.net/ with success.
• String or UUID changes made by this patch: None

Comment 14

[J.C. Jones [:jcj] (he/they)]

Note: D31093 grafts cleanly to esr68. Thanks for the ping, Ryan.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9064801 [details]
Bug 1551594 - Support HmacSecret webauthn extension

Improves Edge feature parity in enterprise environments. Approved for 68.1esr.

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-esr68/rev/a162b7b46c13

Comment 17

[J.C. Jones [:jcj] (he/they)]

Akshay confirmed this works great.