Impossible to verify webauthn because firefox is not following the specification
Categories
(Core :: DOM: Web Authentication, defect)
Tracking
()
People
(Reporter: garciacampos.sergio, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Steps to reproduce:
Request any signature from using the webauthn api
Actual results:
here is an example of the value returned by firefoz where you can see the ordering of the elements is not correct:
{"challenge":"A3WyI4nsXmuT6Knyayt-wB26u0psJWyxfyHWsyO4tZ0A","origin":"http://localhost:5173","type":"webauthn.get"}
The webauthn specification indicates that the encoding of the "CollectedClientData" must follow some strict rules,
This is stated clearly in the specification in point "5.8.1.1. Serialization"
https://www.w3.org/TR/webauthn/#clientdatajson-serialization
firefox is not compliant with the standard and this makes it impossible to verify the signature when using the limited verification algorithm.
Expected results:
the returned JSON should follow the rules defined in the webauthn specification n point "5.8.1.1. Serialization"
https://www.w3.org/TR/webauthn/#clientdatajson-serialization
|
||
Comment 1•2 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Core::DOM: Web Authentication' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Updated•2 years ago
|
|
Reporter | |
Comment 3•2 years ago
|
||
it wasn't a complete duplicate as there are more things to fix besides the reordering, i created a new issue here https://bugzilla.mozilla.org/show_bug.cgi?id=1903074
Description
•