1861543 - Error when trying to use Windows Hello registered fingerprint reader/WebAuthn: CredentialContainer request is not allowed.

Status: RESOLVED WORKSFORME

(Core :: DOM: Web Authentication, defect)

Description

[wagwan.piffting.blud]

Attachment: A screenshot of the WebAuthn dialog where the error occurs.

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0

Steps to reproduce:

1. Visit a page allowing WebAuthn, such as https://webauthn.lubu.ch/
2. Click "new registration"
3. Dialog appears to use security key, attempt to use

Actual results:

2 different errors are returned depending on the context. The first is the normal "user cancellation" message when the user inevitably clicks "cancel" after their fingerprint scanner does not light up. This message reads "The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission." The second is when accessing the code through the debugger, when attempting to instantiate the CredentialContainer, the following is returned instead: "CredentialContainer request is not allowed."

Expected results:

The fingerprint scanner or Windows Hello is triggered, allowing the user to use the fingerprint scanner to authenticate.

Comment 1

[John Schanck [:jschanck]]

Do you have security.webauth.webauthn_enable_softtoken set to true? The fact that you see Firefox's WebAuthn prompt rather than Windows Hello suggests to me that you might. That pref is only supposed to be true in automated tests.

Comment 2

[wagwan.piffting.blud]

(In reply to John Schanck [:jschanck] from comment #1)

Do you have security.webauth.webauthn_enable_softtoken set to true? The fact that you see Firefox's WebAuthn prompt rather than Windows Hello suggests to me that you might. That pref is only supposed to be true in automated tests.

It was, disabling it fixed it instantly. I think a note somewhere about this setting should be made, but I am not in charge of that kind of thing. Thanks a ton for the assistance!

Comment 3

[John Schanck [:jschanck]]

Great, glad that worked. We'll probably change the name of that pref.