RESOLVED DUPLICATE of bug 219823 220559
WebAuthn / navigator.credentials.create() does not work in WKWebView-based browsers like Chrome, Firefox 
https://bugs.webkit.org/show_bug.cgi?id=220559
Summary WebAuthn / navigator.credentials.create() does not work in WKWebView-based br...
Urs Wolfer
Reported 2021-01-12 13:00:19 PST
While navigator.credentials.create() works in Safari, it does not work in WKWebView-based apps. Can be reproduced with this demo: https://webauthn.io/
Attachments
Add attachment proposed patch, testcase, etc.
Jiewen Tan
Comment 1 2021-01-13 15:14:50 PST
*** This bug has been marked as a duplicate of bug 219823 ***
Urs Wolfer
Comment 2 2021-01-13 23:20:27 PST
(In reply to Jiewen Tan from comment #1) > > *** This bug has been marked as a duplicate of bug 219823 *** @Jiewen: Thank you for triaging this ticket. Are you sure this is a complete duplicate? From reading the patch in bug 219823 it looks to me as the change only affects the *default* browser. My request was to support it in any WKWebView based browsers or apps.
Jiewen Tan
Comment 3 2021-01-14 00:05:25 PST
(In reply to Urs Wolfer from comment #2) > (In reply to Jiewen Tan from comment #1) > > > > *** This bug has been marked as a duplicate of bug 219823 *** > > @Jiewen: Thank you for triaging this ticket. Are you sure this is a complete > duplicate? From reading the patch in bug 219823 it looks to me as the change > only affects the *default* browser. My request was to support it in any > WKWebView based browsers or apps. We currently aren't considering opening this API for all WKWebViews. If you are going to use a web view to do WebAuthn, I would suggest you to use either ASWebAuthenticationSession or SFSafariViewController.
Urs Wolfer
Comment 4 2021-01-14 00:21:38 PST
(In reply to Jiewen Tan from comment #3) > We currently aren't considering opening this API for all WKWebViews. If you > are going to use a web view to do WebAuthn, I would suggest you to use > either ASWebAuthenticationSession or SFSafariViewController. Are you not considering opening this API because of security concerns? If yes, would it be an idea to only enable the API for "app bound domains" (AFAIK you already enable other security relevant APIs when "app bound domains" is configured). Using either ASWebAuthenticationSession or SFSafariViewController is probably possible, but from a UX point of view not the nicest solution in all cases.
Note You need to log in before you can comment on or make changes to this bug.