Issue metadata
Sign in to add a comment
|
WebAuthn Silent Failure On Bad User Icon Value
Reported by
dsander...@ucsbalum.com,
Nov 3
|
||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 Steps to reproduce the problem: 1. Invoke `navigator.credentials.create` with the user's dict including the `icon` key, but with value `null` What is the expected behavior? Either successfully initiating the credentials registration process, or an error if `null` is not an allowed value. What went wrong? The UI says it is initiating the credentials registration process and says to plug in an authenticator, but the authenticator never activates even if plugged in. As such it's a silent failure, there's no errors in the console, and the UI suggests that everything is working as expected, but you can't complete the process. Did this work before? Yes 68 Does this work in other browsers? N/A Chrome version: 70.0.3538.77 Channel: stable OS Version: OS X 10.14.1 Flash Version: This used to work in older versions of Chromium, definitely in 68. I don't think that `null` for the `icon` key is valid under the spec, but providing a bad value shouldn't lead to a silent failure, it should have a hard error.
,
Nov 5
Thanks for filing the issue... @reporter: Could you please provide a sample file or URL that reproduces the issue, so that it would be really helpful for triaging the issue.
,
Nov 5
,
Nov 5
Hi, can you also add which authenticator you are using? Off the top of my head - one primary difference between 68 and 70 is that now Chrome will use the CTAP2 protocol if the authenticator supports it, and in this protocol the icon value is passed all the way through to the authenticator. If you're using a CTAP2-enabled authenticator, then it's possible that the authenticator itself is choking on the 'null' value. Will take a closer look.
,
Nov 8
,
Nov 17
@kpaulhamus, I'm using a Yubico Security Key: https://www.yubico.com/product/security-key-by-yubico/ It's the version with the 2 on it, which says it supports FIDO2 so I believe that means CTAP2. The authenticator choking on it would explain why the UI looks like the normal process but the authenticator doesn't light up. |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by susan.boorgula@chromium.org
, Nov 4