Closed Bug 2010919 Opened 18 days ago Closed 18 days ago

WebAuthn calls with unsupported mediation requirements should be rejected

Categories

(Core :: DOM: Web Authentication, defect, P2)

Product:
Core
Component:
DOM: Web Authentication
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
149 Branch
Tracking Flags:
Tracking Status
firefox-esr140 --- fixed
firefox147 --- fixed
firefox148 --- fixed
firefox149 --- fixed

People

(Reporter: jschanck, Assigned: jschanck)

Details

Attachments

(4 files)

Bug 2010919 - reject unsupported webauthn mediation requirements. r=keeler
48 bytes, text/x-phabricator-request
Details | Review
Bug 2010919 - reject unsupported webauthn mediation requirements.
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-beta+
Details | Review
Bug 2010919 - reject unsupported webauthn mediation requirements.
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-esr140+
Details | Review
Bug 2010919 - reject unsupported webauthn mediation requirements.
48 bytes, text/x-phabricator-request
phab-bot
: approval-mozilla-release+
Details | Review
No description provided.

https://hg.mozilla.org/mozilla-central/rev/4ec475428644

Status: ASSIGNED → RESOLVED
Closed: 18 days ago
status-firefox149: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 149 Branch

firefox-beta Uplift Approval Request

  • User impact if declined: Unexpected WebAuthn prompts on sites that are using the new "conditional create" WebAuthn feature (https://github.com/w3c/webauthn/wiki/Explainer:-Conditional-Create).
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: Prior to this patch we were completely ignoring the mediation option to navigator.credentials.create. With this patch we allow-list the values of the mediation option that we support and explicitly return a NotSupported error for values that we do not.
  • String changes made/needed: none
  • Is Android affected?: yes
Attachment #9538905 - Flags: approval-mozilla-beta?

firefox-esr140 Uplift Approval Request

  • User impact if declined: Unexpected WebAuthn prompts on sites that are using the new "conditional create" WebAuthn feature (https://github.com/w3c/webauthn/wiki/Explainer:-Conditional-Create).
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: Prior to this patch we were completely ignoring the mediation option to navigator.credentials.create. With this patch we allow-list the values of the mediation option that we support and explicitly return a NotSupported error for values that we do not.
  • String changes made/needed: none
  • Is Android affected?: yes
Attachment #9538907 - Flags: approval-mozilla-esr140?

firefox-release Uplift Approval Request

  • User impact if declined: Unexpected WebAuthn prompts on sites that are using the new "conditional create" WebAuthn feature (https://github.com/w3c/webauthn/wiki/Explainer:-Conditional-Create).
  • Code covered by automated testing: yes
  • Fix verified in Nightly: yes
  • Needs manual QE test: no
  • Steps to reproduce for manual QE testing:
  • Risk associated with taking this patch: low
  • Explanation of risk level: Prior to this patch we were completely ignoring the mediation option to navigator.credentials.create. With this patch we allow-list the values of the mediation option that we support and explicitly return a NotSupported error for values that we do not.
  • String changes made/needed: none
  • Is Android affected?: yes
Attachment #9538908 - Flags: approval-mozilla-release?
Attachment #9538905 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
Attachment #9538908 - Flags: approval-mozilla-release? → approval-mozilla-release+
Attachment #9538907 - Flags: approval-mozilla-esr140? → approval-mozilla-esr140+
You need to log in before you can comment on or make changes to this bug.