Bug 220559 - WebAuthn / navigator.credentials.create() does not work in WKWebView-based browsers like Chrome, Firefox
Summary: WebAuthn / navigator.credentials.create() does not work in WKWebView-based br...
Status: RESOLVED DUPLICATE of bug 219823
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: Safari 14
Hardware: iPhone / iPad iOS 14
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-01-12 13:00 PST by Urs Wolfer
Modified: 2021-01-14 00:21 PST (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Urs Wolfer 2021-01-12 13:00:19 PST 
While navigator.credentials.create() works in Safari, it does not work in WKWebView-based apps.

Can be reproduced with this demo: https://webauthn.io/
Comment 1 Jiewen Tan 2021-01-13 15:14:50 PST 

*** This bug has been marked as a duplicate of bug 219823 ***
Comment 2 Urs Wolfer 2021-01-13 23:20:27 PST 
(In reply to Jiewen Tan from comment #1)
> 
> *** This bug has been marked as a duplicate of bug 219823 ***

@Jiewen: Thank you for triaging this ticket. Are you sure this is a complete duplicate? From reading the patch in bug 219823 it looks to me as the change only affects the *default* browser. My request was to support it in any WKWebView based browsers or apps.
Comment 3 Jiewen Tan 2021-01-14 00:05:25 PST 
(In reply to Urs Wolfer from comment #2)
> (In reply to Jiewen Tan from comment #1)
> > 
> > *** This bug has been marked as a duplicate of bug 219823 ***
> 
> @Jiewen: Thank you for triaging this ticket. Are you sure this is a complete
> duplicate? From reading the patch in bug 219823 it looks to me as the change
> only affects the *default* browser. My request was to support it in any
> WKWebView based browsers or apps.

We currently aren't considering opening this API for all WKWebViews. If you are going to use a web view to do WebAuthn, I would suggest you to use either ASWebAuthenticationSession or SFSafariViewController.
Comment 4 Urs Wolfer 2021-01-14 00:21:38 PST 
(In reply to Jiewen Tan from comment #3)
> We currently aren't considering opening this API for all WKWebViews. If you
> are going to use a web view to do WebAuthn, I would suggest you to use
> either ASWebAuthenticationSession or SFSafariViewController.


Are you not considering opening this API because of security concerns? If yes, would it be an idea to only enable the API for "app bound domains" (AFAIK you already enable other security relevant APIs when "app bound domains" is configured).

Using either ASWebAuthenticationSession or SFSafariViewController is probably possible, but from a UX point of view not the nicest solution in all cases.