1854568 - Add support for the "webauthn:virtualAuthenticators" capability

Status: NEW

(Remote Protocol :: Marionette, defect, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

The Web Authentication specification defines a webauthn:virtualAuthenticators boolean capability which indicates whether the endpoint node supports all Virtual Authenticators commands.

Currently we do not set this capability for the new session command for WebDriver classic, which was basically missed on bug 1846574.

I wonder if geckodriver should be updated to set this capability to false for older versions of Firefox.

Comment 1

[David Dick]

Attachment: webauthn_capabilities.patch

Patch provided

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

David, can you please use Phabricator to submit your patch? We are no longer handling reviews for patches as attachments. Please see the documentation for details. Thanks!

Comment 3

[David Dick]

Attachment: Bug 1854568 - Add capability "webauthn:virtualAuthenticators" into WebDriver classic's new session capabilities r?whimboo

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:whimboo, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Hi David, I wanted to ask if you are interested to continue working on this bug to get this capability added. I'm happy to mentor you. Thanks.

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I actually had a look at the required implementation again and noticed that we actually do not validate capabilities in Marionette but only geckodriver. So the proposed patch is fine for setting the default, but fails when the capability is passed in with a false value. Then in the returned session capabilities the webauthn:virtualAuthenticators's value is also set to false even through we support all virtual authenticators. It means that in the fromJSON() method we can only make sure that the type is correct.

Beside that I noticed that we have quite a few other authenticator extension capabilities set set as well. While webauthn:extension:uvm and webauthn:extension:largeBlob can be found in the WebAuthentication specification, there is no mentioning for webauthn:extension:prf and webauthn:extension:credBlob.

Dana, do you know why you've added those two extra capabilities?

Comment 7

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Here's the prf extension: https://w3c.github.io/webauthn/#prf-extension
Here's the credBlob extension: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#sctn-credBlob-extension
The capabilities were included in the original patch I adapted from a contributor in bug 1676679.

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Oh, that's based on the editors draft of level 3. These capabilities cannot be found in the W3C hosted spec, which I was referring to. So if we support that new webauthn extensions then I'm fine. Thanks!

Comment 9

[Dana Keeler (she/her) (use needinfo) [:keeler]]

We don't support them yet. I believe we intend to support prf (see bug 1863819), but not credBlob or largeBlob. I guess those capabilities can be removed?