1888851 - Incorrect clientDataJSON order to support limited verification order

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[Firas A]

Steps to reproduce:

When generating a clientDataJSON after calling navigator.credentials.get() using WebAuthn, the order of the clientDataJSON produced is challenge, origin, type

Expected results:

While not required by the specification, having it be in the mentioned order-type, challenge, origin-would allow compatibility with verifiers which use the Limited Verification Algorithm defined in 5.8.1.2 https://www.w3.org/TR/webauthn-3/#clientdatajson-verification. It would also align with other browsers that produce clientDataJSON objects in this format

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1888851 - reorder clientDataJSON properties to support limited verifiers. r=keeler

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8bc3e2fd3625
reorder clientDataJSON properties to support limited verifiers. r=webidl,smaug,keeler

Comment 4

[garciacampos.sergio]

Hi, I don't see anywhere in the spec that the serialization algorithm is optional, it looks like it's mandatory to me https://www.w3.org/TR/webauthn-3/#clientdatajson-serialization

Also, I want to clarify that this is not just about reordering the fields, for instance the 'crossOrigin' attribute is mandatory and not always present today. Best to follow the steps laid out int the spec to guarantee compatibility

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/8bc3e2fd3625

Comment 6

[John Schanck [:jschanck]]

Attachment: Bug 1888851 - reorder clientDataJSON properties to support limited verifiers. r=keeler

Original Revision: https://phabricator.services.mozilla.com/D207322

Comment 7

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: WebAuthn operations may fail on some sites.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: The patch just changes the order of properties in a JSON object.
• String changes made/needed: none
• Is Android affected?: yes

Comment 8

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/fb09f2643b23