U2F/WebAuthn security key confirmation dialogue causes urgency WM_HINT on all windows
Categories
(Core :: DOM: Web Authentication, defect)
Tracking
()
People
(Reporter: simon.marquardt, Unassigned)
Details
Attachments
(2 files)
User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Steps to reproduce:
- Open more than one Firefox window
- Open a login/registration page which supports WebAuthn or U2F, e.g. https://webauthn.io
- Start a procedure which causes an authentication request from an security key through WebAuthn or U2F (“$domain wants to authenticate you using a registered security key. …” or “$domain wants to register an account with one of your security keys.“), e.g. registration or login on webauthn.io
Noteworthy, similar dialogues like a geolocation request do not lead to this behaviour, the urgency hint is only set for the causing window.
(Tested in 68.0.1 and 69.0b14 on Arch Linux using X11 and i3 wm, was also present in earlier versions)
Actual results:
The security key request leads to an Urgency WM_HINT on all Firefox windows of the current session. The Urgency hints do not vanish when the procedure is completed or cancelled. The hint has to be unset by the window manager, usually through interacting with every single window (at least in my case using i3-wm, but I do not think it is different with any other WM)
Expected results:
The urgency hint should only be caused on the window with the tab which caused the request. And it should be gone after confirmation/abortion of the process (which probably happens automatically through the WM when the user interacts with the window).
Comment 1•5 years ago
|
||
I tested this issue on Ubuntu 18.04 with Firefox release 68 and FF Nightly 70.0a1(2019-08-22) and I don't receive the urgency hint on any browser windows.
I tested with a new profile without any add-ons.
Please test if the issue is reproducible in safe mode, here is a link that can help you:
https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode
Please download Firefox Nightly from here: https://nightly.mozilla.org/ and retest the problem.
Reporter | ||
Comment 2•5 years ago
|
||
I already tested the Developer Edition with a clean profile, I now repeated that using Nightly and I also tried safe mode. I also tested Manjaro-i3, Lubuntu 19.04 on freshly installed VMs and Ubuntu 19.04 in a live CD environment, and I tested today’s Nightly on each system. The behaviour is similar on each system.
The behaviour I mean is the following on each WM:
i3: title bar is coloured in the colour which is configured for client.urgent
LXDE an most WMs with a Windows-like taskbar: The taskbar entry starts blinking
Gnome: In Gnome a “<window name> is ready” Notification is shown for each window, a click on it raises the Window.
The property which causes this seems to be _NET_WM_STATE(ATOM) = _NET_WM_STATE_DEMANDS_ATTENTION
(confirmed using xprop -id <window-id> _NET_WM_STATE
after I found the specification, WM_HINTS seems to be replaced by this).
I also noticed that the fingerprint icon and popup for the security key permission request also appears in the focused tab of the other window when the other window is raised without confirming or aborting the security request before (I’ll attach another screenshot).
Reporter | ||
Comment 3•5 years ago
|
||
Steps to this screenshot:
- opened two firefox windows, one with webauthn.io
- clicked register on webauthn.io
- the “webauthn.io wants to register an account with…” popup appears on the webauthn.io tab, the other window demands attention through
_NET_WM_STATE_DEMANDS_ATTENTION
- switched to the other window without either pressing Cancel nor inserting a security key
- the popup and fingerprint icon in url bar now appear on the tab of the unrelated tab in the other window
This behaviour is unique to security key-requests, e.g. a geolocation request does stay in its tab and does not affect other windows
Comment 4•5 years ago
•
|
||
(In reply to simon.marquardt from comment #3)
- the popup and fingerprint icon in URL bar now appears on the tab of the unrelated tab in the other window
I tested on Mac OS X 10.14 with FF Nightly 70.0a1(2019-08-23) and I have the same behavior.
J.C.Jones can you please take a look at this issue? I know that you are working on Web Authentication and I was wondering if this is related with that part, thanks in advance.
Maybe you can tell us if this is intended or not.
Reporter | ||
Comment 6•5 years ago
|
||
(In reply to J.C. Jones [:jcj] (he/him) from comment #5)
Is this basically the same as bug 1573190?
Yes, the notifications seem to be Gnome’s way to handle the “demands attention” window state.
Comment 7•5 years ago
|
||
Thanks J.C. Jones for your help on this and also Simon for the updates. Based on comment 6 I will mark this as Duplicate after bug 1573190.
Description
•