1858222 - navigator.credentials.get fails with more than 8 allowCredentials are passed

Status: UNCONFIRMED

(Core :: DOM: Credential Management, defect)

Description

[Glyphos]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0

Steps to reproduce:

yubikey 5C nfc plugged in. platform linux.

Call navigator.credentials.get with 9 allowCredentials

Object { publicKey: {…} }
​ publicKey: Object {
​​allowCredentials: Array(9) [ {…}, {…}, {…}, … ]
​​challenge: ArrayBuffer { byteLength: 32 }
​​rpId: "localhost"
​​timeout: 1800000
​​userVerification: "discouraged" }

Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0

Actual results:

Immediate failure with DOMException: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission.

Order does not matter. The operation immediately fails regardless of where in the list the attached credential is listed. No user verification ceremony begins at all.

If no yubikey is present, it will wait with the "touch your security key to continue" dialog box. But if one is present, the key flashes once then immediately fails.

When 8 or fewer options are passed, the authentication ceremony proceeds, and after user verification is complete, it succeeds if the attached yubikey was one of the listed allowCredentials, and fails if it was not.

This could lock people out of login and/or 2fA system after registering their ninth webauthn device of any type. This would force users to switch to a different browser to access the site, because firefox would no longer be able to participate in authentication.

Expected results:

Works on chromium derived browsers; if the attached hardware device has/is one of the allowedCredentials, authentication should progress.

I see that 119 has some fixes related to ordering of allowCredentials, but this issue seems to happen based strictly on the length of allowCredentials and does not seem sensitive to ordering.

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:bvandersloot, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Patryk Gruszka]

I have tried to reproduce this problem with Yubikey 5 NFC and two versions of FF.

Firefox/115.0 - problem exists
Firefox/122.0 - no error with 9 values, FF asks to touch the security key

But with 21 and more elements in the allowCredentials array, I'm getting different errors for both 115 and 122 FF versions:
DOMException: The operation is insecure.

Comment 3

[Patryk Gruszka]

This limit is hardcoded in the WebAuthnManager.cpp file:

const size_t MAX_ALLOWED_CREDENTIALS = 20;

So I think the problem you had is already fixed in version 122 and at the moment you can define a maximum of 20 allowedCredentials. The limit was introduced in https://bugzilla.mozilla.org/show_bug.cgi?id=1730434