1933195 - Several WebAuthn endpoints do not work and throw a "405 Method Not Allowed" error

Status: RESOLVED FIXED

(Testing :: geckodriver, defect, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Originally filed as https://github.com/mozilla/geckodriver/issues/2187.

Running curl on an active WebDriver session and trying to eg. adding a virtual authenticator geckodriver fails with the above mentioned error. Here an example:

$ curl -vvv -d "{}" -H 'Content-Type: application/json' 127.0.0.1:4444/session/709a661e-e94f-4755-934b-1cda5a4426c0/webauthn/authenticator
*   Trying 127.0.0.1:4444...
* Connected to 127.0.0.1 (127.0.0.1) port 4444
> POST /session/709a661e-e94f-4755-934b-1cda5a4426c0/webauthn/authenticator HTTP/1.1
> Host: 127.0.0.1:4444
> User-Agent: curl/8.4.0
> Accept: */*
> Content-Type: application/json
> Content-Length: 2
>
< HTTP/1.1 405 Method Not Allowed
< content-type: text/plain; charset=utf-8
< content-length: 23
< date: Mon, 25 Nov 2024 13:39:11 GMT

As it looks like our WebAuthn implementation is not complete or some patch matching doesn't work in geckodriver given that it's all implemented in Marionette.

It would be nice if we would log a line to stdout in case we see a non-supported route. Right now there is no log at all.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

As per the WebAuthn specification the above URL fragment is correct.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

The problem here is that we actually setup the routes for /sessions/{session_id}/... but not for /session/{session_id}/.... As it looks like no-one ever used these webauthn commands yet since we released geckodriver 0.34.0! Otherwise we would have clearly got failure reports.

I would suggest to just fix the route handling for the upcoming geckodriver 0.37.0 release, and follow-up with webdriver tests in another bug.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I filed bug 1948775 for creating the tests.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: Bug 1933195 - [geckodriver] Fix route registration for WebAuthn commands.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: Bug 1933195 - [geckodriver] Add trace logs for registered standard and extension routes.

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Bumping to P2 because all the methods are actually broken.

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3ab5882d8aa9
[geckodriver] Fix route registration for WebAuthn commands. r=webdriver-reviewers,jdescottes
https://hg.mozilla.org/integration/autoland/rev/21956037ce19
[geckodriver] Add trace logs for registered standard and extension routes. r=webdriver-reviewers,jgraham

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/3ab5882d8aa9
https://hg.mozilla.org/mozilla-central/rev/21956037ce19

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Including the investigation necessary the fix isn't worth more than 2 points.