Bug 219814 - `navigator.credentials.get()` immediately fails if a different security key is plugged in
Summary: `navigator.credentials.get()` immediately fails if a different security key i...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: Safari 14
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 181943
  Show dependency treegraph
 
Reported: 2020-12-11 16:35 PST by Lucas Garron
Modified: 2020-12-18 16:36 PST (History)
2 users (show)

See Also:


Attachments
Screen capture of the UX in question (1.67 MB, video/quicktime)
2020-12-11 16:35 PST, Lucas Garron
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Lucas Garron 2020-12-11 16:35:09 PST
Created attachment 416069 [details]
Screen capture of the UX in question

Reproduction steps:

1. Register a security key on GitHub.com
2. On a MacBook Pro with macOS Big Sur 11.0, plug in a *different* security key.
3. Log into the account with registered in step 1.

Observed:

At the security key step, Safari flashes the security key prompt, but immediately removes it and replaces it with a "Found no credentials on this device" explanation.

Expected:

The user is prompted to insert a security key, as if the correct (or no) security key was currently inserted.

The current behaviour somewhat makes sense if you assume that a user only has a single security key that they would ever plug into a given device (or perhaps if the device can only hold one security key that is generally not left in permanently, as on iOS), but it will result in a rather confusing UX if someone:

1. Has two computers with a permanently plugged-in security key each.
2. Registers a security key in computer.
3. Tries to log into the other computer (perhaps to try to register the other key).

If they didn't switch the keys ahead of the prompt (quite likely if they don't immediately do step 3 after step 2), they get this issue.

If the user is not given a chance to plug in another security key, it would be helpful if the prompt at least explained the reason (one key is already plugged in, and it doesn't have a valid registration for the site).
Comment 1 Radar WebKit Bug Importer 2020-12-18 16:36:19 PST
<rdar://problem/72485080>