Bug 298951
| Summary: | WebAuthn Signal API PublicKeyCredential.signalAllAcceptedCredentials() never resolves | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Kostas <k> |
| Component: | DOM | Assignee: | pascoe <pascoe> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | brandonjorg123, matthew, pascoe, webkit-bug-importer, wilander |
| Priority: | P3 | Keywords: | InRadar |
| Version: | Safari 26 | ||
| Hardware: | All | ||
| OS: | All | ||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=278339 | ||
Kostas
We reported this here: https://bugs.webkit.org/show_bug.cgi?id=278339, but we are not sure if it might be overlooked since the issue is already marked as RESOLVED.
Hey,
we have tried this out in the current Safari Technology Preview, Release 216 (Safari 18.4, WebKit 20622.1.7.2) on macOS 15.3.1.
Is it possible that the Promise returned from signalAllAcceptedCredentials does not resolve?
This is our test code:
// @ts-ignore
if (!window.PublicKeyCredential || !window.PublicKeyCredential.signalAllAcceptedCredentials) {
return undefined;
}
// @ts-ignore
console.log('Running signalAllAcceptedCredentials');
try {
// @ts-ignore
await window.PublicKeyCredential.signalAllAcceptedCredentials({
rpId: rpId,
userId: userId,
allAcceptedCredentialIds: credentialIds,
});
console.log('Signal all accepted credentials success');
} catch (e) {
console.log('Signal all accepted credentials error', e);
return;
}
What we observe:
- signalAllAcceptedCredentials is not defined on PublicKeyCredential => "Running signalAllAcceptedCredentials" is being logged
- neither "Signal all accepted credentials success" nor "Signal all accepted credentials error" are being logged => the signalAllAcceptedCredentials seems to block
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/161170398>
Matthew Miller (Cisco)
Chiming in at the start of November to report that this issue is still a problem as of Safari 26.0.1, as well as in Safari Technology Preview 231. The call _does_ lead to the deletion of a passkey that's stored in Passwords.app, but because the Promise doesn't resolve then nothing in `.then()/.catch()`, or `try/catch` with `await`, can run afterwards.
Here's a basic HTML doc that can be used to replicate the problem:
```html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Document</title>
</head>
<body>
<button id="promiseChain">Click to chain signal Promise</button>
<button id="promiseAwait">Click to await signal Promise</button>
<script>
document.getElementById("promiseChain").addEventListener("click", () => {
PublicKeyCredential.signalAllAcceptedCredentials({
rpId: "localhost",
userId: "c2FmYXJp",
allAcceptedCredentialIds: [],
})
.then(() => {
console.log("Called signalAllAcceptedCredentials()");
})
.catch(console.error);
});
document.getElementById("promiseAwait").addEventListener("click", async () => {
try {
await PublicKeyCredential.signalAllAcceptedCredentials({
rpId: "localhost",
userId: "c2FmYXJp",
allAcceptedCredentialIds: [],
});
console.log("Called signalAllAcceptedCredentials()");
} catch (err) {
console.error(err);
}
});
</script>
</body>
</html>
```
Matthew Miller (Cisco)
A follow-up since, coincidentally, the 26.1 releases dropped this week. This problem still exists in macOS Safari 26.1.
pascoe@apple.com
Pull request: https://github.com/WebKit/WebKit/pull/55585
EWS
Committed 304633@main (7ffbbd3abece): <https://commits.webkit.org/304633@main>
Reviewed commits have been landed. Closing PR #55585 and removing active labels.