New issue
Advanced search Search tips

Issue 854557 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jul 30
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

The note, which is intended to clarify what an RPID is, makes things even less clear

Reported by antonio....@gmail.com, Jun 20 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Steps to reproduce the problem:
The WebAuthn specs says [1]
A Public key credential's scope is for a Relying Party's origin, with the following restrictions
   and relaxations:

    * The scheme is always https (i.e., a restriction), and,

    * the host may be equal to the Relying Party's origin's effective domain, or it may be equal 
    to a registrable domain suffix of the Relying Party's origin's effective domain (i.e., an available
    relaxation), and,

    * all (TCP) ports on that host (i.e., a relaxation).

   This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies,
   [RFC6265]). Please note that this is a greater relaxation of "same-origin" restrictions than what
   document.domain's setter provides.

The keys are supposed to be bound to specific domains but Chrome has a small glitch on the logic port

You can find a POC in https://www.intothesymmetry.com/

As you can see the Security Key works as a charm even if  a different port is used

 navigator.credentials.create({
    publicKey: {
      challenge: new TextEncoder().encode(challenge),
      pubKeyCredParams: [{
        type: 'public-key',
        alg: cose_alg_ECDSA_w_SHA256
      }],
      rp: {
        id: 'www.intothesymmetry.com:5001',
        name: 'Nov Sample'
      },
      user: user
    }
  }).then(registered);
};

See view-source:https://www.intothesymmetry.com/u2f.js

[1] https://w3c.github.io/webauthn/#rp-id

What is the expected behavior?
this should work

What went wrong?

Uncaught (in promise) DOMException: The relying party ID 'www.intothesymmetry.com:5001' is not a registrable domain suffix of, nor equal to 'https://www.intothesymmetry.com'.

Did this work before? N/A 

Does this work in other browsers? N/A

Chrome version: 67.0.3396.87  Channel: stable
OS Version: OS X 10.13.3
Flash Version:
 
Components: Blink>WebAuthentication

Comment 2 by engedy@chromium.org, Jun 20 2018

Labels: -OS-Mac
Owner: engedy@chromium.org
Status: Started (was: Unconfirmed)
Thanks for the report, Antonio!

I agree that the part you quoted from the spec is rather unclear and should be rephrased.

The intention of the spec (and the behavior of Chrome) is that the API can be called with the RPID "example.com" from any the following origins:

https://example.com
https://example.com:5001
https://login.example.com

However, the format of the RPID is always a domain name, that is, "example.com", so it cannot have a scheme or a port.

Comment 3 by engedy@chromium.org, Jun 20 2018

Summary: The note, which is intended to clarify what an RPID is, makes things even less clear (was: Web Authentication - violations of the WebAuthn spec)
see https://github.com/w3c/webauthn/issues/963 (submitted by engendy (thx))
Status: Fixed (was: Started)
Antonio, can you please take a look at the new text and let us know if it is clearer now? I'll close this bug now, but reopen if you think there is still way to go.

https://w3c.github.io/webauthn/#relying-party-identifier
LGTM now thanks!!
Glad to hear that!
Status: Verified (was: Fixed)

Sign in to add a comment