Bug 196046 – [WebAuthN] Add a quirk for google.com when processing AppID extension

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Alexei Czeskis]

For historical reasons (being the first U2F implementor) Google uses a non-standard (cross-origin) AppID.  The App ID is “www.gstatic.com” for logins to “google.com” and its subdomains.

This bug requests an exception on the cross-origin check for valid AppIds in the case of google.com and gstatic.com.

Both Chrome and Firefox already make this exception.

Firefox tracking bug and implementation:
  https://bugzilla.mozilla.org/show_bug.cgi?id=1436078

Chrome's implementation:
  https://cs.chromium.org/chromium/src/content/browser/webauth/authenticator_common.cc?l=252&rcl=4d674f923c5a1f03b2262132cb621a3db78f7562

[Radar WebKit Bug Importer]

<rdar://problem/49088479>

[Jiewen Tan]

Created attachment 368761 [details]
Patch

[Brent Fulgham]

Comment on attachment 368761 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=368761&action=review

> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
> +{

Please add a comment:

"
FIXME(BUG #): Remove this quirk in 2023
As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
Google users to seamlessly transition to proper WebAuthN behavior.
"

Then please file a bug to remove this quirk in 2023.

[Jiewen Tan]

Comment on attachment 368761 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=368761&action=review

>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
>> +{
> 
> Please add a comment:
> 
> "
> FIXME(BUG #): Remove this quirk in 2023
> As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
> Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
> Google users to seamlessly transition to proper WebAuthN behavior.
> "
> 
> Then please file a bug to remove this quirk in 2023.

Added.

[Jiewen Tan]

(In reply to Brent Fulgham from comment #3)
> Comment on attachment 368761 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=368761&action=review
> 
> > Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
> > +{
> 
> Please add a comment:
> 
> "
> FIXME(BUG #): Remove this quirk in 2023
> As an early adopter of U2F features, Google has a large number of existing
> device registrations that authenticate 'google.com' against 'gstatic.com'.
> Firefox and other browsers have agreed to grant an exception to the AppId
> rules for a limited time period (5 years from January, 2018) to allow
> existing
> Google users to seamlessly transition to proper WebAuthN behavior.
> "
> 
> Then please file a bug to remove this quirk in 2023.

Thanks Brent for r+ this patch.

[Jiewen Tan]

Created attachment 368798 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 368798 [details]
Patch for landing

Clearing flags on attachment: 368798

Committed r244879: <https://trac.webkit.org/changeset/244879>

[Simon Fraser (smfr)]

Comment on attachment 368761 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=368761&action=review

>>>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
>>>> +{
>>> 
>>> Please add a comment:
>>> 
>>> "
>>> FIXME(BUG #): Remove this quirk in 2023
>>> As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
>>> Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
>>> Google users to seamlessly transition to proper WebAuthN behavior.
>>> "
>>> 
>>> Then please file a bug to remove this quirk in 2023.
>> 
>> Added.
> 
> Thanks Brent for r+ this patch.

This needs to go through the Quirks class so that the Develop menu switch can turn it off.

[Jiewen Tan]

(In reply to Simon Fraser (smfr) from comment #8)
> Comment on attachment 368761 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=368761&action=review
> 
> >>>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
> >>>> +{
> >>> 
> >>> Please add a comment:
> >>> 
> >>> "
> >>> FIXME(BUG #): Remove this quirk in 2023
> >>> As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
> >>> Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
> >>> Google users to seamlessly transition to proper WebAuthN behavior.
> >>> "
> >>> 
> >>> Then please file a bug to remove this quirk in 2023.
> >> 
> >> Added.
> > 
> > Thanks Brent for r+ this patch.
> 
> This needs to go through the Quirks class so that the Develop menu switch
> can turn it off.

I would argue it is not meaningful to turn Quirks off. Basically, the whole WebAuthentication feature will not work in Google.com if this is off.

[Wenson Hsieh]

Comment on attachment 368761 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=368761&action=review

>>>>>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
>>>>>> +{
>>>>> 
>>>>> Please add a comment:
>>>>> 
>>>>> "
>>>>> FIXME(BUG #): Remove this quirk in 2023
>>>>> As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
>>>>> Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
>>>>> Google users to seamlessly transition to proper WebAuthN behavior.
>>>>> "
>>>>> 
>>>>> Then please file a bug to remove this quirk in 2023.
>>>> 
>>>> Added.
>>> 
>>> Thanks Brent for r+ this patch.
>> 
>> This needs to go through the Quirks class so that the Develop menu switch can turn it off.
> 
> I would argue it is not meaningful to turn Quirks off. Basically, the whole WebAuthentication feature will not work in Google.com if this is off.

I believe the utility in being able to turn off quirks is that web developers can easily test their content against the un-quirked browser engine, to make sure that their content will work when we finally remove the quirk.

[Jiewen Tan]

(In reply to Wenson Hsieh from comment #10)
> Comment on attachment 368761 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=368761&action=review
> 
> >>>>>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:84
> >>>>>> +{
> >>>>> 
> >>>>> Please add a comment:
> >>>>> 
> >>>>> "
> >>>>> FIXME(BUG #): Remove this quirk in 2023
> >>>>> As an early adopter of U2F features, Google has a large number of existing device registrations that authenticate 'google.com' against 'gstatic.com'.
> >>>>> Firefox and other browsers have agreed to grant an exception to the AppId rules for a limited time period (5 years from January, 2018) to allow existing
> >>>>> Google users to seamlessly transition to proper WebAuthN behavior.
> >>>>> "
> >>>>> 
> >>>>> Then please file a bug to remove this quirk in 2023.
> >>>> 
> >>>> Added.
> >>> 
> >>> Thanks Brent for r+ this patch.
> >> 
> >> This needs to go through the Quirks class so that the Develop menu switch can turn it off.
> > 
> > I would argue it is not meaningful to turn Quirks off. Basically, the whole WebAuthentication feature will not work in Google.com if this is off.
> 
> I believe the utility in being able to turn off quirks is that web
> developers can easily test their content against the un-quirked browser
> engine, to make sure that their content will work when we finally remove the
> quirk.

I don't think they would have any un-quirked version. I probably shouldn't name this as quirks.