New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 823736 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

U2F Not available in extensions

Reported by jamespi...@googlemail.com, Mar 20 2018

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/64.0.3282.167 Chrome/64.0.3282.167 Safari/537.36

Steps to reproduce the problem:
In a Chrome extension (or the dev tools console for an existing running Chrome extension), attempt to send a message to the U2F extension:

chrome.runtime.sendMessage('kmendfapggjehodndflmmgagdbamhnfd', {
        type: 'u2f_sign_request',
        signRequests: []
  }, function() {
  if (!chrome.runtime.lastError) {
    // We are on a whitelisted origin and can talk directly
    // with the extension.
    console.log('Success')
  } else {
    // chrome.runtime was available, but we couldn't message
    // the extension directly, use iframe
    console.log(chrome.runtime.lastError)
  }
});

What is the expected behavior?
"Success" is logged to the console, as it would be if this code were run by a web page.

What went wrong?
'{message: "Could not establish connection. Receiving end does not exist."}' is logged to the console, indicating that it was not possible to send the message.

Did this work before? No 

Does this work in other browsers? Yes

Chrome version: 64.0.3282.167  Channel: stable
OS Version: Ubuntu 16.04
Flash Version: 

The iframe trampoline technique described in https://github.com/google/u2f-ref-code/blob/master/u2f-chrome-extension/README.md also doesn't work.
 
Components: -Blink>USB Blink>WebAuthentication
Labels: Needs-Milestone
Owner: arnarb@chromium.org

Comment 4 by arnarb@chromium.org, Mar 20 2018

Status: WontFix (was: Unconfirmed)
This is working as intended. There is currently no clean way of determining an appropriate origin of an extension for the purposes of populating clientData in the U2F protocol. Thus U2F support is limited to web pages.

Sign in to add a comment