New issue
Advanced search Search tips

Issue 851593 link

Starred by 1 user

Issue metadata

Status: Started
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Focus checks should still report that a WebContents has focus if we are showing our very own dialog

Project Member Reported by engedy@chromium.org, Jun 11 2018

Issue description

Now that we are showing a modal dialog while a WebAuthn request is active, enforcing the focus requirements outline in https://www.w3.org/TR/webauthn/#abortoperation became even more complicated.

First of all, as discussed on crrev.com/c/1092859, instead of using `browser->window()->IsActive()`, we should have been using WebContents::GetVisibility to tell if a tab is visible in the first place.

Then, depending on how that function handles web-modal dialogs, we may need to extend that check so that it also returns true if the WebAuthn dialog is showing. Once we have that, and once we have made showing UI for WebAuthn the default behavior, we may even consider solely relying on the WebAuthn dialog visiblity checks.


 

Comment 1 by engedy@chromium.org, Jun 11 2018

Components: Blink>WebAuthentication
Project Member

Comment 2 by bugdroid1@chromium.org, Jun 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a275018ea52d2039212735aaeb45aaf77c1b654f

commit a275018ea52d2039212735aaeb45aaf77c1b654f
Author: Balazs Engedy <engedy@chromium.org>
Date: Wed Jun 13 07:45:26 2018

Decouple creating AuthenticatorRequestClientDelegate from showing UI.

This allows AuthenticatorImpl to first create the delegate and ask it if the
WebContents has focus, and only then triggering the request dialog (which may
steal the focus), so as to avoid race conditions around focus checking at
request start.

The CL also fixes fake FidoDiscoveries to use weak pointers so as to support
being immediately destroyed after the discovery is started.

Bug:  849323 , 851593
Change-Id: Iae4ac25dc39b527e5481836e4522a6f4da7e31ba
Reviewed-on: https://chromium-review.googlesource.com/1095619
Commit-Queue: Balazs Engedy <engedy@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Reviewed-by: Adam Langley <agl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#566750}
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/chrome/browser/webauthn/chrome_authenticator_request_delegate.cc
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/chrome/browser/webauthn/chrome_authenticator_request_delegate.h
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/content/browser/webauth/authenticator_impl.cc
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/content/browser/webauth/authenticator_impl_unittest.cc
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/content/public/browser/authenticator_request_client_delegate.cc
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/content/public/browser/authenticator_request_client_delegate.h
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/device/fido/fake_fido_discovery.cc
[modify] https://crrev.com/a275018ea52d2039212735aaeb45aaf77c1b654f/device/fido/scoped_virtual_fido_device.cc

Labels: Hotlist-WebAuthnUI

Sign in to add a comment