1761199 - Webauthn Attestation object credential length is invalid

Status: RESOLVED DUPLICATE of bug 1759162

(Core :: DOM: Web Authentication, defect)

Description

[djpjvs]

Firefox for Android

Steps to reproduce:

On my windows Firefox

I created a webauthn credential with additional attestation data. Asking for direct attestation.

Using something similar to https://webauthn.bin.coffee/

Actual results:

The [authdata] [attested cred data] [length] bytes report 32396 instead of the length of the credential.

This results in security keys not working when additional credential data is used

Expected results:

The credentialID length should be the length of the CredentialID. It the moment it give a value that is far from the expected details.

This is working in 97 but not in 98

Comment 1

[djpjvs]

Attachment: Failing attestation data

When CBOR decoding the response.attestationObject and check bytes 53 and 54 it give length of 32396 instead of the length of the credentialID.

Comment 2

[djpjvs]

Attachment: Success attachment

Here, when decoded the credential length is 96 which is correct

Comment 3

[djpjvs]

Seems to be related to https://bugzilla.mozilla.org/show_bug.cgi?id=1759162

Issue seems to be gone in 98.0.2

Comment 4

[R. Martinho Fernandes [:rmf]]

Is this on Windows or on Android?

Comment 5

[djpjvs]

is was on both Windows and Android, but it seems like issue is gone in 98.0.2

Comment 6

[R. Martinho Fernandes [:rmf]]

Ok, then I guess I can close this. Thanks for reporting.