1878742 - [WebAuthn] macOS Firefox 122 does not respect transports during security key authentication

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[Matthew Miller]

Attachment: Firefox showing the user a choice when the RP communicates only a single valid option via transports in allowCredentials

Steps to reproduce:

Complete the following steps on macOS 14.3 with a USB security key (I used a YubiKey 5 Nano) to reproduce:

Registration:

(We have to use a different browser here until https://bugzilla.mozilla.org/show_bug.cgi?id=1878397 is fixed and we get transports from security key registration in Firefox)

1. Open Safari
2. Open Safari's JavaScript Console
3. Go to https://webauthn.io/?regUserVerification=discouraged&attestation=none&attachment=cross_platform&algES256=true&algRS256=true&discoverableCredential=discouraged&regHints=&authUserVerification=preferred
4. Enter a username
5. Click "Register" to call navigator.credentials.create()
6. Select "Security key" from the macOS system prompt
7. Tap security key (and enter PIN and re-tap if needed)
8. Observe in Safari's JavaScript Console that response.transports is populated with a USB transport (e.g. ["usb"])

Authentication:

1. Open Firefox
2. Open Firefox's Web Developer Tools
3. Go to https://webauthn.io/?regUserVerification=discouraged&attestation=none&attachment=cross_platform&algES256=true&algRS256=true&discoverableCredential=discouraged&regHints=&authUserVerification=preferred
4. Enter the same username as above
5. Click "Authenticate" to call navigator.credentials.get()
6. Observe in Firefox's Console that the transports property in the sole entry in allowCredentials contains ["usb"] as seen during registration
7. Observe that Firefox prompts the user to choose between "iPhone, iPad, or Android device" or "Security key"

Actual results:

Firefox prompted me to choose between "iPhone, iPad, or Android device" or "Security key" via the macOS system prompt.

Expected results:

Firefox should have jumped straight to the security key option because the "iPhone, iPad, or Android device" option is for the "hybrid" transport which was not present anywhere in allowCredentials.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jschanck, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[John Schanck [:jschanck]]

On macOS 13.5+ we can fix this by toggling the shouldShowHybridTransport bit on ASAuthorizationPlatformPublicKeyCredentialAssertionRequest based on the transports that are present in the allowlist.

Comment 4

[John Schanck [:jschanck]]

Attachment: Bug 1878742 - only show hybrid transport option on macOS if it might be used. r=dveditz

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ed724b89a2c2
only show hybrid transport option on macOS if it might be used. r=dveditz

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/ed724b89a2c2