⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 284838 in webkit


Ignore:
Timestamp:
Oct 25, 2021, 2:51:24 PM (5 years ago)
Author:
Alan Coon
Message:

Cherry-pick r284532. rdar://problem/84625267

Source/WebKit:
[WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
​https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>

Patch by John Pascoe <J Pascoe> on 2021-10-20
Reviewed by Brent Fulgham.

Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
of makeCredential (​https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
and return a different error depending on consent was obtained.

A fixme to add this was inadvertently removed in ​https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch

Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent

  • UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm: (WebKit::LocalAuthenticator::makeCredential):

Tools:
[WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
​https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>

Patch by John Pascoe <J Pascoe> on 2021-10-20
Reviewed by Brent Fulgham.

Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
of makeCredential (​https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
and return a different error depending on consent was obtained.

This adds a test to confirm a different path is taken whenever consent is obtained.

  • TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm: (TestWebKitAPI::TEST):

LayoutTests:
WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
​https://bugs.webkit.org/show_bug.cgi?id=219813
<rdar://problem/72484635>

Patch by John Pascoe <J Pascoe> on 2021-10-20
Reviewed by Brent Fulgham.

Modify layout tests to reflect different exception returned when consent is provided

  • http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
  • http/wpt/webauthn/public-key-credential-create-failure-local.https.html:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:
branches/safari-612-branch
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • branches/safari-612-branch/LayoutTests/ChangeLog

    r284836 r284838  
     12021-10-25  Null  <null@apple.com>
     2
     3        Cherry-pick r284532. rdar://problem/84625267
     4
     5    Source/WebKit:
     6    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     7    https://bugs.webkit.org/show_bug.cgi?id=219813
     8    <rdar://problem/72484635>
     9   
     10    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     11    Reviewed by Brent Fulgham.
     12   
     13    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     14    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     15    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     16    and return a different error depending on consent was obtained.
     17   
     18    A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch
     19   
     20    Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
     21   
     22    * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
     23    (WebKit::LocalAuthenticator::makeCredential):
     24   
     25    Tools:
     26    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     27    https://bugs.webkit.org/show_bug.cgi?id=219813
     28    <rdar://problem/72484635>
     29   
     30    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     31    Reviewed by Brent Fulgham.
     32   
     33    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     34    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     35    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     36    and return a different error depending on consent was obtained.
     37   
     38    This adds a test to confirm a different path is taken whenever consent is obtained.
     39   
     40    * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     41    (TestWebKitAPI::TEST):
     42   
     43    LayoutTests:
     44    WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     45    https://bugs.webkit.org/show_bug.cgi?id=219813
     46    <rdar://problem/72484635>
     47   
     48    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     49    Reviewed by Brent Fulgham.
     50   
     51    Modify layout tests to reflect different exception returned when consent is provided
     52   
     53    * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
     54    * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
     55   
     56    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     57
     58    2021-10-20  John Pascoe  <j_pascoe@apple.com>
     59
     60            WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     61            https://bugs.webkit.org/show_bug.cgi?id=219813
     62            <rdar://problem/72484635>
     63
     64            Reviewed by Brent Fulgham.
     65
     66            Modify layout tests to reflect different exception returned when consent is provided
     67
     68            * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
     69            * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
     70
    1712021-10-25  Null  <null@apple.com>
    272

  • branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html

    r270619 r284838  
    5151        if (window.testRunner)
    5252            testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
    53         return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "Operation timed out.").then(() => {
     53        return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
    5454            if (window.testRunner)
    5555                testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
    … …  
    8585        if (window.testRunner)
    8686            testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
    87         return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "Operation timed out.").then(() => {
     87        return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
    8888            if (window.testRunner)
    8989                testRunner.cleanUpKeychain(testRpId, credentialIDBase64);

  • branches/safari-612-branch/LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-local.https.html

    r269360 r284838  
    4949        if (window.testRunner)
    5050            testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
    51         return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
     51        return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
    5252            if (window.testRunner)
    5353                testRunner.cleanUpKeychain(testRpId, credentialIDBase64);
    … …  
    8282        if (window.testRunner)
    8383            testRunner.addTestKeyToKeychain(privateKeyBase64, testRpId, testUserEntityBundleBase64);
    84         return promiseRejects(t, "NotAllowedError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
     84        return promiseRejects(t, "InvalidStateError", navigator.credentials.create(options), "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator.").then(() => {
    8585            if (window.testRunner)
    8686                testRunner.cleanUpKeychain(testRpId, credentialIDBase64);

  • branches/safari-612-branch/Source/WebKit/ChangeLog

    r284837 r284838  
     12021-10-25  Null  <null@apple.com>
     2
     3        Cherry-pick r284532. rdar://problem/84625267
     4
     5    Source/WebKit:
     6    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     7    https://bugs.webkit.org/show_bug.cgi?id=219813
     8    <rdar://problem/72484635>
     9   
     10    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     11    Reviewed by Brent Fulgham.
     12   
     13    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     14    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     15    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     16    and return a different error depending on consent was obtained.
     17   
     18    A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch
     19   
     20    Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
     21   
     22    * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
     23    (WebKit::LocalAuthenticator::makeCredential):
     24   
     25    Tools:
     26    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     27    https://bugs.webkit.org/show_bug.cgi?id=219813
     28    <rdar://problem/72484635>
     29   
     30    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     31    Reviewed by Brent Fulgham.
     32   
     33    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     34    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     35    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     36    and return a different error depending on consent was obtained.
     37   
     38    This adds a test to confirm a different path is taken whenever consent is obtained.
     39   
     40    * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     41    (TestWebKitAPI::TEST):
     42   
     43    LayoutTests:
     44    WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     45    https://bugs.webkit.org/show_bug.cgi?id=219813
     46    <rdar://problem/72484635>
     47   
     48    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     49    Reviewed by Brent Fulgham.
     50   
     51    Modify layout tests to reflect different exception returned when consent is provided
     52   
     53    * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
     54    * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
     55   
     56    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     57
     58    2021-10-20  John Pascoe  <j_pascoe@apple.com>
     59            [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     60            https://bugs.webkit.org/show_bug.cgi?id=219813
     61            <rdar://problem/72484635>
     62
     63            Reviewed by Brent Fulgham.
     64
     65            Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     66            always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     67            of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     68            and return a different error depending on consent was obtained.
     69
     70            A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch
     71
     72            Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
     73
     74            * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
     75            (WebKit::LocalAuthenticator::makeCredential):
     76
    1772021-10-25  Null  <null@apple.com>
    278

  • branches/safari-612-branch/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm

    r278358 r284838  
    236236            return excludeCredentialIds.contains(base64EncodeToString(rawId->data(), rawId->byteLength()));
    237237        })) {
    238             receiveException({ NotAllowedError, "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator."_s }, WebAuthenticationStatus::LAExcludeCredentialsMatched);
     238            // Obtain consent per Step 3.1
     239            auto callback = [weakThis = WeakPtr { *this }] (LocalAuthenticatorPolicy policy) {
     240                ASSERT(RunLoop::isMain());
     241                if (!weakThis)
     242                    return;
     243
     244                if (policy == LocalAuthenticatorPolicy::Allow)
     245                    weakThis->receiveException({ InvalidStateError, "At least one credential matches an entry of the excludeCredentials list in the platform attached authenticator."_s }, WebAuthenticationStatus::LAExcludeCredentialsMatched);
     246                else
     247                    weakThis->receiveException({ NotAllowedError, "This request has been cancelled by the user."_s });
     248            };
     249            observer()->decidePolicyForLocalAuthenticator(WTFMove(callback));
    239250            return;
    240251        }

  • branches/safari-612-branch/Tools/ChangeLog

    r284824 r284838  
     12021-10-25  Null  <null@apple.com>
     2
     3        Cherry-pick r284532. rdar://problem/84625267
     4
     5    Source/WebKit:
     6    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     7    https://bugs.webkit.org/show_bug.cgi?id=219813
     8    <rdar://problem/72484635>
     9   
     10    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     11    Reviewed by Brent Fulgham.
     12   
     13    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     14    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     15    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     16    and return a different error depending on consent was obtained.
     17   
     18    A fixme to add this was inadvertently removed in https://bugs.webkit.org/attachment.cgi?id=393180&action=prettypatch
     19   
     20    Added api test TestWebKitAPI.WebAuthenticationPanel.LADuplicateCredentialWithConsent
     21   
     22    * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
     23    (WebKit::LocalAuthenticator::makeCredential):
     24   
     25    Tools:
     26    [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     27    https://bugs.webkit.org/show_bug.cgi?id=219813
     28    <rdar://problem/72484635>
     29   
     30    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     31    Reviewed by Brent Fulgham.
     32   
     33    Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     34    always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     35    of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     36    and return a different error depending on consent was obtained.
     37   
     38    This adds a test to confirm a different path is taken whenever consent is obtained.
     39   
     40    * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     41    (TestWebKitAPI::TEST):
     42   
     43    LayoutTests:
     44    WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     45    https://bugs.webkit.org/show_bug.cgi?id=219813
     46    <rdar://problem/72484635>
     47   
     48    Patch by John Pascoe <j_pascoe@apple.com> on 2021-10-20
     49    Reviewed by Brent Fulgham.
     50   
     51    Modify layout tests to reflect different exception returned when consent is provided
     52   
     53    * http/wpt/webauthn/public-key-credential-create-failure-local-silent.https.html:
     54    * http/wpt/webauthn/public-key-credential-create-failure-local.https.html:
     55   
     56    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@284532 268f45cc-cd09-0410-ab3c-d52691b4dbfc
     57
     58    2021-10-20  John Pascoe  <j_pascoe@apple.com>
     59            [WebAuthn] Obtain consent to create new credential when platform authenticator in excludedCredentials
     60            https://bugs.webkit.org/show_bug.cgi?id=219813
     61            <rdar://problem/72484635>
     62
     63            Reviewed by Brent Fulgham.
     64
     65            Currently, whenever the platform authenticator is within excludedCredentials during makeCredential we
     66            always return NotAllowedError and merely flash a consent screen. This does not match the spec per Step 3.1
     67            of makeCredential (https://w3c.github.io/webauthn/#sctn-op-make-cred). Instead, we should always obtain consent
     68            and return a different error depending on consent was obtained.
     69
     70            This adds a test to confirm a different path is taken whenever consent is obtained.
     71
     72            * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     73            (TestWebKitAPI::TEST):
     74
    1752021-10-25  Null  <null@apple.com>
    276

  • branches/safari-612-branch/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm

    r284824 r284838  
    13851385    ASSERT_TRUE(addKeyToKeychain(testES256PrivateKeyBase64, "", testUserEntityBundleBase64));
    13861386    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
     1387    Util::run(&webAuthenticationPanelFailed);
     1388    cleanUpKeychain("");
     1389}
     1390
     1391TEST(WebAuthenticationPanel, LADuplicateCredentialWithConsent)
     1392{
     1393    reset();
     1394    RetainPtr<NSURL> testURL = [[NSBundle mainBundle] URLForResource:@"web-authentication-make-credential-la-duplicate-credential" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
     1395
     1396    auto *configuration = [WKWebViewConfiguration _test_configurationWithTestPlugInClassName:@"WebProcessPlugInWithInternals" configureJSCForTesting:YES];
     1397    [[configuration preferences] _setEnabled:YES forExperimentalFeature:webAuthenticationExperimentalFeature()];
     1398    [[configuration preferences] _setEnabled:NO forExperimentalFeature:webAuthenticationModernExperimentalFeature()];
     1399
     1400    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSZeroRect configuration:configuration]);
     1401    auto delegate = adoptNS([[TestWebAuthenticationPanelUIDelegate alloc] init]);
     1402    [webView setUIDelegate:delegate.get()];
     1403    [webView focus];
     1404
     1405    ASSERT_TRUE(addKeyToKeychain(testES256PrivateKeyBase64, "", testUserEntityBundleBase64));
     1406
     1407    localAuthenticatorPolicy = _WKLocalAuthenticatorPolicyAllow;
     1408
     1409    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
    13871410    Util::run(&webAuthenticationPanelUpdateLAExcludeCredentialsMatched);
    13881411    cleanUpKeychain("");
Note: See TracChangeset for help on using the changeset viewer.