1877332 - WebAuthn create requests in a cross-origin iframe must consume user activation

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[John Schanck [:jschanck]]

See Step 2.2 of https://w3c.github.io/webauthn/#sctn-createCredential. Curiously there is no requirement to consume user activation for cross-origin get requests.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1877332 - consume user activation in webauthn cross-origin iframe create request. r=keeler

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/63688f915f53
consume user activation in webauthn cross-origin iframe create request. r=keeler

Comment 3

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/63688f915f53

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jschanck, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox123 to wontfix.

For more information, please visit BugBot documentation.

Comment 5

[John Schanck [:jschanck]]

Comment on attachment 9377071 [details]
Bug 1877332 - consume user activation in webauthn cross-origin iframe create request. r=keeler

Beta/Release Uplift Approval Request

• User impact if declined: WebAuthn credential creation requests in (appropriately permissioned) cross-origin iframes are allowed when the main frame is active. The request should require user activation in the iframe.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Low risk as the change is well covered by tests.
• String changes made/needed:
• Is Android affected?: Yes

Comment 6

[Pascal Chevrel:pascalc]

Comment on attachment 9377071 [details]
Bug 1877332 - consume user activation in webauthn cross-origin iframe create request. r=keeler

Approved for 123 beta 6, thanks.

Comment 7

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/9ac0e7add01d

Comment 8

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-beta/rev/9ac0e7add01d