Bug 239807 – [WebAuthn] .get() with UV = "discouraged" and no allowList has "PIN Unrecognized" error on some security key

• Component: WebKit Misc.
• Status: NEW

[nuno.sung]

Created attachment 458436 [details]
.get() PIN unrecognized

[Environment]
macOS Big Sur 11.6.5
MacBook Pro(Retina, 13-inch, Mid 2014)
STP: Release-143(Safari 15.4, WebKit 16614.1.7.7)
Safari: 15.4 (16613.1.17.1.13, 16613)
[Repro Steps]

1. Use an external security key with option.alwaysUv=true like Yubikey Bio and only setup clientPIN (no fingerprint)
2. Use website for test"https://webauthntest.azurewebsites.net/".
3. Click "+" to create credential, Require Resident Key=true, Attestation=Direct and others are default undefined > Click "Create"
4. Follow the step on screen to finish registration(Safari ask for touch > PIN > touch) >> Reg should be fine
5. Repeat step3~4 to create 3 credentials with different user-Info
6. Click "Get credential", UV=discourage, Use allowCredentials=unchecked
7. Click "GET" and enter correct clientPIN

[Result]
1. "Unrecognized PIN code" error is showing
2. The dialog for selecting multi-credentials cannot be showed up as other .get() UV settings to Undefined/Prefered/Required and failed to get Credential.

[Note]
I guess this maybe relative the modification of https://bugs.webkit.org/show_bug.cgi?id=206547, other browsers like Chrome/Edge will send .get() command with pinUvAuthToken directly in this case.

[Radar WebKit Bug Importer]

<rdar://problem/92722577>