[Webkit-unassigned] [Bug 232977] _WKWebAuthenticationPanel should expose a way to encode CTAP commands

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=232977

--- Comment #12 from j_pascoe at apple.com <j_pascoe at apple.com> ---
(In reply to Garrett Davidson from comment #9)
> > Any reason we can't do this?
> 
> Sorry I thought I replied inline on the old patch but I'm not sure what
> happened to it.
> 
> Part of the WebAuthn API contract is that the caller needs the original
> clientDataJSON back, which is used during signature verification, so the
> full value needs to be exposed anywhere a command is encoded. That said,
> _WKWebAuthenticationPanel could definitely start using
> AuthenticatorCoordinator::produceClientDataJson internally instead of having
> its own copy, and/or the other methods on _WKWebAuthenticationPanel could
> accept a full clientDataJSON as well. I think those would both be
> independent of this change though.

We already made _WKWebAuthenticationPanel start using AuthenticatorCoordinator::produceClientDataJson internally in https://trac.webkit.org/changeset/285617/webkit as using a different implementation broke WebAuthn due to the signature not matching the client data json returned.

The complete ClientDataJson is only needed for returning via the api, which is already done in AuthenticatorCoordinator.cpp:238. Everywhere else, ClientDataHash can be passed around. The authenticator does not need this value, noted here: https://www.w3.org/TR/webauthn-3/#iface-authenticatorresponse

To complete same-site i-frames, we are going to have to add a crossOrigin flag to ClientDataJson, which is complicated by _WKWebAuthenticationPanel also having an SPI to calculate ClientDataJson, so we're going to have to end up removing it and likely changing these new SPIs.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211115/d2433f04/attachment.htm>