Changeset 291625 in webkit


Ignore:
Timestamp:
Mar 22, 2022 10:12:15 AM (4 months ago)
Author:
J Pascoe
Message:

[WebAuthn] Pass along timeout to ASA and ignore timeout for conditional mediation requests
​https://bugs.webkit.org/show_bug.cgi?id=238147
rdar://90509464

Reviewed by Brent Fulgham.

Source/WebKit:

Currently we don't pass the timeout from the rp into ASA, so the default timeout is always used.
This patch starts passing along the timeout to ASA, and creates a place for ASA to specify the
mediation of the request, so we can ignore the timeout for requests using conditional mediation.

Modified API test.

  • Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:
  • UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h:
  • UIProcess/API/Cocoa/_WKWebAuthenticationPanel.mm:

(toWebCore):
(-[_WKWebAuthenticationPanel makeCredentialWithMediationRequirement:clientDataHash:options:completionHandler:]):
(-[_WKWebAuthenticationPanel makeCredentialWithClientDataHash:options:completionHandler:]):
(-[_WKWebAuthenticationPanel getAssertionWithMediationRequirement:clientDataHash:options:completionHandler:]):
(-[_WKWebAuthenticationPanel getAssertionWithClientDataHash:options:completionHandler:]):

  • UIProcess/WebAuthentication/AuthenticatorManager.cpp:

(WebKit::AuthenticatorManager::respondReceived):
(WebKit::AuthenticatorManager::initTimeOutTimer):

  • UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:

(WebKit::configureRegistrationRequestContext):
(WebKit::configureAssertionOptions):

Tools:

Modify API test to use new SPI.

  • TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(TestWebKitAPI::TEST):

Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r291624 r291625  
     12022-03-22  J Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Pass along timeout to ASA and ignore timeout for conditional mediation requests
     4        https://bugs.webkit.org/show_bug.cgi?id=238147
     5        rdar://90509464
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Currently we don't pass the timeout from the rp into ASA, so the default timeout is always used.
     10        This patch starts passing along the timeout to ASA, and creates a place for ASA to specify the
     11        mediation of the request, so we can ignore the timeout for requests using conditional mediation.
     12
     13        Modified API test.
     14
     15        * Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:
     16        * UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h:
     17        * UIProcess/API/Cocoa/_WKWebAuthenticationPanel.mm:
     18        (toWebCore):
     19        (-[_WKWebAuthenticationPanel makeCredentialWithMediationRequirement:clientDataHash:options:completionHandler:]):
     20        (-[_WKWebAuthenticationPanel makeCredentialWithClientDataHash:options:completionHandler:]):
     21        (-[_WKWebAuthenticationPanel getAssertionWithMediationRequirement:clientDataHash:options:completionHandler:]):
     22        (-[_WKWebAuthenticationPanel getAssertionWithClientDataHash:options:completionHandler:]):
     23        * UIProcess/WebAuthentication/AuthenticatorManager.cpp:
     24        (WebKit::AuthenticatorManager::respondReceived):
     25        (WebKit::AuthenticatorManager::initTimeOutTimer):
     26        * UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:
     27        (WebKit::configureRegistrationRequestContext):
     28        (WebKit::configureAssertionOptions):
     29
    1302022-03-22  J Pascoe  <j_pascoe@apple.com>
    231

  • trunk/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h

    r291177 r291625  
    165165@property (nonatomic, nullable, readonly, copy) NSString *userVerificationPreference;
    166166@property (nonatomic, nullable, copy) ASCWebAuthenticationExtensionsClientInputs *extensions;
     167@property (nonatomic, nullable, copy) NSNumber *timeout;
    167168
    168169@property (nonatomic, nullable, readonly, copy) NSArray<ASCPublicKeyCredentialDescriptor *> *allowedCredentials;
    … …  
    195196@property (nonatomic, nullable, copy) NSString *attestationPreference;
    196197@property (nonatomic, nullable, copy) ASCWebAuthenticationExtensionsClientInputs *extensions;
     198@property (nonatomic, nullable, copy) NSNumber *timeout;
    197199
    198200@property (nonatomic) BOOL shouldRequireResidentKey;

  • trunk/Source/WebKit/UIProcess/API/Cocoa/_WKWebAuthenticationPanel.h

    r290154 r291625  
    8787} WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
    8888
     89typedef NS_ENUM(NSInteger, _WKWebAuthenticationMediationRequirement) {
     90    _WKWebAuthenticationMediationRequirementSilent,
     91    _WKWebAuthenticationMediationRequirementOptional,
     92    _WKWebAuthenticationMediationRequirementRequired,
     93    _WKWebAuthenticationMediationRequirementConditional,
     94} WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
     95
    8996WK_EXPORT extern NSString * const _WKLocalAuthenticatorCredentialNameKey;
    9097WK_EXPORT extern NSString * const _WKLocalAuthenticatorCredentialDisplayNameKey;
    … …  
    142149- (void)makeCredentialWithChallenge:(NSData *)challenge origin:(NSString *)origin options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler WK_API_AVAILABLE(macos(12.0), ios(15.0));
    143150- (void)makeCredentialWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
     151- (void)makeCredentialWithMediationRequirement:(_WKWebAuthenticationMediationRequirement)mediation clientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
    144152- (void)getAssertionWithChallenge:(NSData *)challenge origin:(NSString *)origin options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler WK_API_AVAILABLE(macos(12.0), ios(15.0));
    145153- (void)getAssertionWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
     154- (void)getAssertionWithMediationRequirement:(_WKWebAuthenticationMediationRequirement)mediation clientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler WK_API_AVAILABLE(macos(WK_MAC_TBA), ios(WK_IOS_TBA));
    146155- (void)cancel;
    147156

  • trunk/Source/WebKit/UIProcess/API/Cocoa/_WKWebAuthenticationPanel.mm

    r291176 r291625  
    4949#import <WebCore/CBORReader.h>
    5050#import <WebCore/CBORWriter.h>
     51#import <WebCore/CredentialRequestOptions.h>
    5152#import <WebCore/DeviceRequestConverter.h>
    5253#import <WebCore/FidoConstants.h>
    … …  
    787788    return result;
    788789}
     790
     791static WebCore::CredentialRequestOptions::MediationRequirement toWebCore(_WKWebAuthenticationMediationRequirement mediation)
     792{
     793    switch (mediation) {
     794    case _WKWebAuthenticationMediationRequirementSilent:
     795        return WebCore::CredentialRequestOptions::MediationRequirement::Silent;
     796    case _WKWebAuthenticationMediationRequirementOptional:
     797        return WebCore::CredentialRequestOptions::MediationRequirement::Optional;
     798    case _WKWebAuthenticationMediationRequirementRequired:
     799        return WebCore::CredentialRequestOptions::MediationRequirement::Required;
     800    case _WKWebAuthenticationMediationRequirementConditional:
     801        return WebCore::CredentialRequestOptions::MediationRequirement::Conditional;
     802    default:
     803        ASSERT_NOT_REACHED();
     804        return WebCore::CredentialRequestOptions::MediationRequirement::Optional;
     805    }
     806}
    789807#endif
    790808
    … …  
    845863}
    846864
    847 - (void)makeCredentialWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler
     865- (void)makeCredentialWithMediationRequirement:(_WKWebAuthenticationMediationRequirement)mediation clientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler
    848866{
    849867#if ENABLE(WEB_AUTHN)
    … …  
    855873        });
    856874    };
    857     _panel->handleRequest({ vectorFromNSData(clientDataHash), [_WKWebAuthenticationPanel convertToCoreCreationOptionsWithOptions:options], nullptr, WebKit::WebAuthenticationPanelResult::Unavailable, nullptr, std::nullopt, { }, true, String(), nullptr, std::nullopt, std::nullopt }, WTFMove(callback));
    858 #endif
     875    _panel->handleRequest({ vectorFromNSData(clientDataHash), [_WKWebAuthenticationPanel convertToCoreCreationOptionsWithOptions:options], nullptr, WebKit::WebAuthenticationPanelResult::Unavailable, nullptr, std::nullopt, { }, true, String(), nullptr, toWebCore(mediation), std::nullopt }, WTFMove(callback));
     876#endif
     877}
     878
     879- (void)makeCredentialWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialCreationOptions *)options completionHandler:(void (^)(_WKAuthenticatorAttestationResponse *, NSError *))handler
     880{
     881    [self makeCredentialWithMediationRequirement:_WKWebAuthenticationMediationRequirementOptional clientDataHash:clientDataHash options:options completionHandler:handler];
    859882}
    860883
    … …  
    909932}
    910933
    911 - (void)getAssertionWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler
     934- (void)getAssertionWithMediationRequirement:(_WKWebAuthenticationMediationRequirement)mediation clientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler
    912935{
    913936#if ENABLE(WEB_AUTHN)
    … …  
    919942        });
    920943    };
    921     _panel->handleRequest({ vectorFromNSData(clientDataHash), [_WKWebAuthenticationPanel convertToCoreRequestOptionsWithOptions:options], nullptr, WebKit::WebAuthenticationPanelResult::Unavailable, nullptr, std::nullopt, { }, true, String(), nullptr, std::nullopt, std::nullopt }, WTFMove(callback));
    922 #endif
     944    _panel->handleRequest({ vectorFromNSData(clientDataHash), [_WKWebAuthenticationPanel convertToCoreRequestOptionsWithOptions:options], nullptr, WebKit::WebAuthenticationPanelResult::Unavailable, nullptr, std::nullopt, { }, true, String(), nullptr, toWebCore(mediation), std::nullopt }, WTFMove(callback));
     945#endif
     946}
     947
     948- (void)getAssertionWithClientDataHash:(NSData *)clientDataHash options:(_WKPublicKeyCredentialRequestOptions *)options completionHandler:(void (^)(_WKAuthenticatorAssertionResponse *, NSError *))handler
     949{
     950    [self getAssertionWithMediationRequirement:_WKWebAuthenticationMediationRequirementOptional clientDataHash:clientDataHash options:options completionHandler:handler];
    923951}
    924952

  • trunk/Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp

    r290893 r291625  
    282282{
    283283    ASSERT(RunLoop::isMain());
    284     if (!m_requestTimeOutTimer.isActive())
     284    if (!m_requestTimeOutTimer.isActive() && (m_pendingRequestData.mediation != WebCore::CredentialRequestOptions::MediationRequirement::Conditional || !m_pendingCompletionHandler))
    285285        return;
    286286    ASSERT(m_pendingCompletionHandler);
    … …  
    426426void AuthenticatorManager::initTimeOutTimer()
    427427{
     428    if (m_pendingRequestData.mediation == WebCore::CredentialRequestOptions::MediationRequirement::Conditional)
     429        return;
    428430    std::optional<unsigned> timeOutInMs;
    429431    WTF::switchOn(m_pendingRequestData.options, [&](const PublicKeyCredentialCreationOptions& options) {

  • trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm

    r291196 r291625  
    242242        [requestContext setSecurityKeyCredentialCreationOptions:credentialCreationOptions.get()];
    243243
    244     if (options.extensions && [credentialCreationOptions respondsToSelector:@selector(setExtensions:)])
     244    if (options.extensions)
    245245        [credentialCreationOptions setExtensions:toASCExtensions(*options.extensions).get()];
     246
     247    if (options.timeout && [credentialCreationOptions respondsToSelector:@selector(setTimeout:)])
     248        credentialCreationOptions.get().timeout = [NSNumber numberWithUnsignedInt:*options.timeout];
    246249
    247250    return requestContext;
    … …  
    258261        [assertionOptions initWithKind:ASCPublicKeyCredentialKindPlatform relyingPartyIdentifier:options.rpId challenge:challenge.get() userVerificationPreference:userVerification.get() allowedCredentials:allowedCredentials.get()];
    259262    }
    260     if (options.extensions && [assertionOptions respondsToSelector:@selector(setExtensions:)])
     263    if (options.extensions)
    261264        [assertionOptions setExtensions:toASCExtensions(*options.extensions).get()];
    262265    if (parentOrigin && [assertionOptions respondsToSelector:@selector(setDestinationSiteForCrossSiteAssertion:)])
    … …  
    264267    else if (parentOrigin && ![assertionOptions respondsToSelector:@selector(setDestinationSiteForCrossSiteAssertion:)])
    265268        return nil;
     269    if (options.timeout && [assertionOptions respondsToSelector:@selector(setTimeout:)])
     270        assertionOptions.get().timeout = [NSNumber numberWithUnsignedInt:*options.timeout];
    266271    return assertionOptions;
    267272}

  • trunk/Tools/ChangeLog

    r291619 r291625  
     12022-03-22  J Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Pass along timeout to ASA and ignore timeout for conditional mediation requests
     4        https://bugs.webkit.org/show_bug.cgi?id=238147
     5        rdar://90509464
     6
     7        Reviewed by Brent Fulgham.
     8
     9        Modify API test to use new SPI.
     10
     11        * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     12        (TestWebKitAPI::TEST):
     13
    1142022-03-21  Jonathan Bedard  <jbedard@apple.com>
    215

  • trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm

    r290652 r291625  
    18681868}
    18691869
    1870 TEST(WebAuthenticationPanel, MakeCredentialLAClientDataHash)
     1870TEST(WebAuthenticationPanel, MakeCredentialLAClientDataHashMediation)
    18711871{
    18721872    reset();
    … …  
    18891889    [panel setDelegate:delegate.get()];
    18901890
    1891     [panel makeCredentialWithClientDataHash:nsHash.get() options:options.get() completionHandler:^(_WKAuthenticatorAttestationResponse *response, NSError *error) {
     1891    [panel makeCredentialWithMediationRequirement:_WKWebAuthenticationMediationRequirementOptional clientDataHash:nsHash.get() options:options.get() completionHandler:^(_WKAuthenticatorAttestationResponse *response, NSError *error) {
    18921892        webAuthenticationPanelRan = true;
    18931893        cleanUpKeychain("example.com");
    … …  
    20892089}
    20902090
    2091 TEST(WebAuthenticationPanel, GetAssertionLAClientDataHash)
     2091TEST(WebAuthenticationPanel, GetAssertionLAClientDataHashMediation)
    20922092{
    20932093    reset();
    … …  
    21062106    [panel setDelegate:delegate.get()];
    21072107
    2108     [panel getAssertionWithClientDataHash:nsHash options:options.get() completionHandler:^(_WKAuthenticatorAssertionResponse *response, NSError *error) {
     2108    [panel getAssertionWithMediationRequirement:_WKWebAuthenticationMediationRequirementOptional clientDataHash:nsHash options:options.get() completionHandler:^(_WKAuthenticatorAssertionResponse *response, NSError *error) {
    21092109        webAuthenticationPanelRan = true;
    21102110        cleanUpKeychain("example.com");
Note: See TracChangeset for help on using the changeset viewer.