Bug 230893

Summary:

Present non-modal dialog to present Webauthn panel without user gesture upon credentials.get/create calls

Product:

WebKit

Reporter:

pascoe <pascoe>

Component:

WebKit Misc.

Assignee:

pascoe <pascoe>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

bfulgham, ews-watchlist, jiewen_tan, webkit-bug-importer, wilander

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	ews-feeder: commit-queue-
Patch	ews-feeder: commit-queue-
Patch	ews-feeder: commit-queue-
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none
Patch	none

pascoe@apple.com

Reported 2021-09-28 08:43:05 PDT

Many sites special case on Safari due to it's user gesture requirement. This change loosens the requirement.

Attachments
Patch (81.12 KB, patch) 2021-09-28 08:48 PDT, pascoe@apple.com	ews-feeder: commit-queue-	Details Formatted Diff Diff
Patch (113.52 KB, patch) 2021-10-11 16:35 PDT, pascoe@apple.com	ews-feeder: commit-queue-	Details Formatted Diff Diff
Patch (109.82 KB, patch) 2021-10-12 15:57 PDT, pascoe@apple.com	ews-feeder: commit-queue-	Details Formatted Diff Diff
Patch (112.33 KB, patch) 2021-10-13 12:55 PDT, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (116.12 KB, patch) 2021-10-13 15:03 PDT, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (116.90 KB, patch) 2021-10-13 17:42 PDT, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (95.13 KB, patch) 2021-12-02 15:40 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (98.82 KB, patch) 2021-12-03 13:47 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (96.19 KB, patch) 2021-12-07 10:44 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Patch (95.95 KB, patch) 2021-12-08 12:40 PST, pascoe@apple.com	no flags	Details Formatted Diff Diff
Show Obsolete (9) View All Add attachment proposed patch, testcase, etc.

pascoe@apple.com

Comment 1 2021-09-28 08:43:21 PDT

rdar://79781342

pascoe@apple.com

Comment 2 2021-09-28 08:48:13 PDT

Created attachment 439479 [details] Patch

Radar WebKit Bug Importer

Comment 3 2021-10-05 08:44:20 PDT

<rdar://problem/83887873>

pascoe@apple.com

Comment 4 2021-10-11 16:35:06 PDT

Created attachment 440855 [details] Patch

pascoe@apple.com

Comment 5 2021-10-12 15:57:56 PDT

Created attachment 441008 [details] Patch

pascoe@apple.com

Comment 6 2021-10-13 12:55:16 PDT

Created attachment 441122 [details] Patch

pascoe@apple.com

Comment 7 2021-10-13 15:03:39 PDT

Created attachment 441139 [details] Patch

pascoe@apple.com

Comment 8 2021-10-13 17:42:58 PDT

Created attachment 441167 [details] Patch

Brent Fulgham

Comment 9 2021-10-15 15:59:03 PDT

Comment on attachment 441167 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=441167&action=review > LayoutTests/ChangeLog:10 > + in the WebAuthn layout tests. Are any of these WebKit-specific tests covered by WPT tests? > LayoutTests/http/wpt/webauthn/ctap-hid-success.https.html:-1 > -<!DOCTYPE html> Did you intend to deactivate the modern WebAuthn stuff in all of these tests? That seems unexpected for this patch.

John Wilander

Comment 10 2021-10-28 09:25:48 PDT

Can you explain in what cases sites need to use these credentials without a user gesture? There's is a tangible risk of allowing instant access to credentials.

John Wilander

Comment 11 2021-10-28 09:27:19 PDT

I remember being part of the discussion on why we added a user gesture requirement.

pascoe@apple.com

Comment 12 2021-10-28 10:03:46 PDT

Credentials can never be used without a user gesture (up=0, without user presence). This is for presenting the modal dialog where you can chose to select a key / insert an authenticator, after a given credential is chosen, there is still a test of user presence. Currently we require a user gesture to present this dialog, but you get a free try without it if you are Dropbox, Microsoft, Google, Twitter, or Facebook. The worry is about websites spamming modal dialogs to prevent users from changing tabs, etc. Unfortunately there's no pre-existing case of a webkit-only non-modal dialog for MacOS that I can find (even mini browser stuff uses NSAlert.)

John Wilander

Comment 13 2021-10-28 10:07:23 PDT

(In reply to j_pascoe@apple.com from comment #12) > Credentials can never be used without a user gesture (up=0, without user > presence). This is for presenting the modal dialog where you can chose to > select a key / insert an authenticator, after a given credential is chosen, > there is still a test of user presence. Currently we require a user gesture > to present this dialog, but you get a free try without it if you are > Dropbox, Microsoft, Google, Twitter, or Facebook. > > The worry is about websites spamming modal dialogs to prevent users from > changing tabs, etc. Unfortunately there's no pre-existing case of a > webkit-only non-modal dialog for MacOS that I can find (even mini browser > stuff uses NSAlert.) Thanks! Please rename the bug to make it clear in which context the user gesture requirement will be relaxed. Regarding user presence. We need to make that clear too. A user can be present but passively so, right? I want to avoid drive-by redirects that can pick up credentials. We already have that problem with cookies which is a multi-year project to rein in.

pascoe@apple.com

Comment 14 2021-10-28 10:39:01 PDT

User presence in the context of WebAuthn is defined as "A test of user presence is a simple form of authorization gesture and technical process where a user interacts with an authenticator by (typically) simply touching it (other modalities may also exist), yielding a Boolean result." with an authorization gesture defined as "a physical interaction performed by a user with an authenticator as part of a ceremony, such as registration or authentication. By making such an authorization gesture, a user provides consent for (i.e., authorizes) a ceremony to proceed." So the case of a user passively present would not count. In the platform authenticator case with Face ID for example, a dialog is presented asking if it's okay for the website to use Face ID, hitting yes here is the test of user presence. This bug refers to changing the behavior of what is required to present that dialog asking if its okay in the first place as its modal on iOS for example and if a site was able to spam it, they would not be able to change tabs or otherwise exit the website. Currently, we require a user gesture on the call to navigator.credentials.create() or navigator.credentials.get() as a way to prevent this. Unfortunately, few rps perform their call to navigator.credentials.create() or navigator.credentials.get() with a user gesture, leading to WebAuthn not working at all in most cases. As a compromise, currently we allow one free use of navigator.credentials.create() or navigator.credentials.get() without an user gesture to present the Webauthn panel if the request comes from a short list of popular websites (Dropbox, Microsoft, Google, Twitter, or Facebook.) This bug is to change the current behavior to give all sites one freebie use of navigator.credentials.create() or navigator.credentials.get() to present the modal ui without an user gesture. Then if another call is made without a gesture, the user will be required to hit allow on a non-modal, pre-dialog to the current dialogs asking the user if they want to use WebAuthn. Also, of note is that there is rumblings of adding non-modal ui for Webauthn to the spec in level 3 here: https://github.com/w3c/webauthn/issues/1545

pascoe@apple.com

Comment 15 2021-12-02 15:40:54 PST

Created attachment 445782 [details] Patch

pascoe@apple.com

Comment 16 2021-12-03 13:47:59 PST

Created attachment 445893 [details] Patch

pascoe@apple.com

Comment 17 2021-12-07 10:44:19 PST

Created attachment 446201 [details] Patch

Brent Fulgham

Comment 18 2021-12-08 11:43:28 PST

Comment on attachment 446201 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=446201&action=review lgtm. r+ > Source/WebKit/UIProcess/API/C/WKPageUIClient.h:1698 > + WKPageRequestWebAuthenticationNoGestureCallback requestWebAuthenticationNoGesture; Nit: Missing two spaces in front of requestWebAuthenticationNoGesture.

pascoe@apple.com

Comment 19 2021-12-08 12:40:48 PST

Created attachment 446411 [details] Patch

pascoe@apple.com

Comment 20 2021-12-08 12:41:18 PST

Thank you for the review, addressed comments.

Brent Fulgham

Comment 21 2021-12-08 12:57:28 PST

Comment on attachment 446411 [details] Patch r=me

EWS

Comment 22 2021-12-09 09:54:42 PST

Committed r286785 (245026@main): <https://commits.webkit.org/245026@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 446411 [details].

Note You need to log in before you can comment on or make changes to this bug.