Bug 192835

Summary: [WebAuthN] userPresence should always be true
Product: WebKit Reporter: Jiewen Tan <jiewen_tan>
Component: WebCore Misc.Assignee: Jiewen Tan <jiewen_tan>
Status: RESOLVED FIXED    
Severity: Normal CC: alex.gaynor, bfulgham, cdumez, commit-queue, jiewen_tan, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 181943    
Attachments:
Description Flags
Patch
none
Patch
bfulgham: review+
Patch for landing none

Jiewen Tan
Reported 2018-12-18 15:32:06 PST
In the current spec, userPresence is suggested to set to the inverse of userVerification, which doesn't comply with the CTAP spec. Details in: https://github.com/w3c/webauthn/issues/1123.
Attachments
Patch (2.80 KB, patch)
2018-12-20 17:34 PST, Jiewen Tan 		no flags
DetailsFormatted DiffDiff
Patch (3.11 KB, patch)
2018-12-20 17:39 PST, Jiewen Tan 		bfulgham: review+
DetailsFormatted DiffDiff
Patch for landing (3.14 KB, patch)
2018-12-21 14:48 PST, Jiewen Tan 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Jiewen Tan
Comment 1 2018-12-18 15:51:23 PST
<rdar://problem/46538788>
Jiewen Tan
Comment 2 2018-12-20 17:34:46 PST
Created attachment 357908 [details] Patch
Jiewen Tan
Comment 3 2018-12-20 17:39:06 PST
Created attachment 357909 [details] Patch
Jiewen Tan
Comment 4 2018-12-20 17:40:51 PST
My suggestion is seconded by Yubico and Microsoft directly on GitHub, and Google via email.
Brent Fulgham
Comment 5 2018-12-21 14:24:32 PST
Comment on attachment 357909 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=357909&action=review r=me > Source/WebCore/ChangeLog:11 > + The change is made to follow my suggestion in the issue as no one has objected it. "After discussing with other members of the working group, we decided to make userPresence always default to true."
Jiewen Tan
Comment 6 2018-12-21 14:44:25 PST
Comment on attachment 357909 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=357909&action=review Thanks Brent for r+ this patch. >> Source/WebCore/ChangeLog:11 >> + The change is made to follow my suggestion in the issue as no one has objected it. > > "After discussing with other members of the working group, we decided to make userPresence always default to true." Fixed.
Jiewen Tan
Comment 7 2018-12-21 14:48:46 PST
Created attachment 357983 [details] Patch for landing
WebKit Commit Bot
Comment 8 2018-12-21 15:27:36 PST
Comment on attachment 357983 [details] Patch for landing Clearing flags on attachment: 357983 Committed r239523: <https://trac.webkit.org/changeset/239523>
Note You need to log in before you can comment on or make changes to this bug.