Closed Bug 1574853 Opened 8 months ago Closed 7 months ago

U2F/WebAuthn security key confirmation dialogue causes urgency WM_HINT on all windows

Categories

(Core :: DOM: Web Authentication, defect)

defect
Not set

Tracking

()

RESOLVED DUPLICATE of bug 1573190
Tracking Status
firefox68 --- affected
firefox69 --- affected
firefox70 --- affected

People

(Reporter: simon.marquardt, Unassigned)

Details

Attachments

(2 files)

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0

Steps to reproduce:

  1. Open more than one Firefox window
  2. Open a login/registration page which supports WebAuthn or U2F, e.g. https://webauthn.io
  3. Start a procedure which causes an authentication request from an security key through WebAuthn or U2F (“$domain wants to authenticate you using a registered security key. …” or “$domain wants to register an account with one of your security keys.“), e.g. registration or login on webauthn.io

Noteworthy, similar dialogues like a geolocation request do not lead to this behaviour, the urgency hint is only set for the causing window.

(Tested in 68.0.1 and 69.0b14 on Arch Linux using X11 and i3 wm, was also present in earlier versions)

Actual results:

The security key request leads to an Urgency WM_HINT on all Firefox windows of the current session. The Urgency hints do not vanish when the procedure is completed or cancelled. The hint has to be unset by the window manager, usually through interacting with every single window (at least in my case using i3-wm, but I do not think it is different with any other WM)

Expected results:

The urgency hint should only be caused on the window with the tab which caused the request. And it should be gone after confirmation/abortion of the process (which probably happens automatically through the WM when the user interacts with the window).

I tested this issue on Ubuntu 18.04 with Firefox release 68 and FF Nightly 70.0a1(2019-08-22) and I don't receive the urgency hint on any browser windows.
I tested with a new profile without any add-ons.

Please test if the issue is reproducible in safe mode, here is a link that can help you:
https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode

Please download Firefox Nightly from here: https://nightly.mozilla.org/ and retest the problem.

Flags: needinfo?(simon.marquardt)

I already tested the Developer Edition with a clean profile, I now repeated that using Nightly and I also tried safe mode. I also tested Manjaro-i3, Lubuntu 19.04 on freshly installed VMs and Ubuntu 19.04 in a live CD environment, and I tested today’s Nightly on each system. The behaviour is similar on each system.

The behaviour I mean is the following on each WM:

i3: title bar is coloured in the colour which is configured for client.urgent
LXDE an most WMs with a Windows-like taskbar: The taskbar entry starts blinking
Gnome: In Gnome a “<window name> is ready” Notification is shown for each window, a click on it raises the Window.

The property which causes this seems to be _NET_WM_STATE(ATOM) = _NET_WM_STATE_DEMANDS_ATTENTION (confirmed using xprop -id <window-id> _NET_WM_STATE after I found the specification, WM_HINTS seems to be replaced by this).

I also noticed that the fingerprint icon and popup for the security key permission request also appears in the focused tab of the other window when the other window is raised without confirming or aborting the security request before (I’ll attach another screenshot).

Flags: needinfo?(simon.marquardt)

Steps to this screenshot:

  1. opened two firefox windows, one with webauthn.io
  2. clicked register on webauthn.io
  3. the “webauthn.io wants to register an account with…” popup appears on the webauthn.io tab, the other window demands attention through _NET_WM_STATE_DEMANDS_ATTENTION
  4. switched to the other window without either pressing Cancel nor inserting a security key
  5. the popup and fingerprint icon in url bar now appear on the tab of the unrelated tab in the other window

This behaviour is unique to security key-requests, e.g. a geolocation request does stay in its tab and does not affect other windows

(In reply to simon.marquardt from comment #3)

  1. the popup and fingerprint icon in URL bar now appears on the tab of the unrelated tab in the other window

I tested on Mac OS X 10.14 with FF Nightly 70.0a1(2019-08-23) and I have the same behavior.

J.C.Jones can you please take a look at this issue? I know that you are working on Web Authentication and I was wondering if this is related with that part, thanks in advance.
Maybe you can tell us if this is intended or not.

Status: UNCONFIRMED → NEW
Component: Untriaged → DOM: Web Authentication
Ever confirmed: true
Flags: needinfo?(jjones)
OS: Unspecified → All
Product: Firefox → Core
Hardware: Unspecified → All
Version: 68 Branch → Trunk

Is this basically the same as bug 1573190?

Flags: needinfo?(jjones)

(In reply to J.C. Jones [:jcj] (he/him) from comment #5)

Is this basically the same as bug 1573190?

Yes, the notifications seem to be Gnome’s way to handle the “demands attention” window state.

Thanks J.C. Jones for your help on this and also Simon for the updates. Based on comment 6 I will mark this as Duplicate after bug 1573190.

Status: NEW → RESOLVED
Closed: 7 months ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1573190
You need to log in before you can comment on or make changes to this bug.