Bug 230893 - Present non-modal dialog to present Webauthn panel without user gesture upon credentials.get/create calls
Summary: Present non-modal dialog to present Webauthn panel without user gesture upon ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: j_pascoe@apple.com
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-09-28 08:43 PDT by j_pascoe@apple.com
Modified: 2021-12-09 09:54 PST (History)
5 users (show)

See Also:


Attachments
Patch (81.12 KB, patch)
2021-09-28 08:48 PDT, j_pascoe@apple.com
ews-feeder: commit-queue-
Details | Formatted Diff | Diff
Patch (113.52 KB, patch)
2021-10-11 16:35 PDT, j_pascoe@apple.com
ews-feeder: commit-queue-
Details | Formatted Diff | Diff
Patch (109.82 KB, patch)
2021-10-12 15:57 PDT, j_pascoe@apple.com
ews-feeder: commit-queue-
Details | Formatted Diff | Diff
Patch (112.33 KB, patch)
2021-10-13 12:55 PDT, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (116.12 KB, patch)
2021-10-13 15:03 PDT, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (116.90 KB, patch)
2021-10-13 17:42 PDT, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (95.13 KB, patch)
2021-12-02 15:40 PST, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (98.82 KB, patch)
2021-12-03 13:47 PST, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (96.19 KB, patch)
2021-12-07 10:44 PST, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff
Patch (95.95 KB, patch)
2021-12-08 12:40 PST, j_pascoe@apple.com
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description j_pascoe@apple.com 2021-09-28 08:43:05 PDT
Many sites special case on Safari due to it's user gesture requirement. This change loosens the requirement.
Comment 1 j_pascoe@apple.com 2021-09-28 08:43:21 PDT
rdar://79781342
Comment 2 j_pascoe@apple.com 2021-09-28 08:48:13 PDT
Created attachment 439479 [details]
Patch
Comment 3 Radar WebKit Bug Importer 2021-10-05 08:44:20 PDT
<rdar://problem/83887873>
Comment 4 j_pascoe@apple.com 2021-10-11 16:35:06 PDT
Created attachment 440855 [details]
Patch
Comment 5 j_pascoe@apple.com 2021-10-12 15:57:56 PDT
Created attachment 441008 [details]
Patch
Comment 6 j_pascoe@apple.com 2021-10-13 12:55:16 PDT
Created attachment 441122 [details]
Patch
Comment 7 j_pascoe@apple.com 2021-10-13 15:03:39 PDT
Created attachment 441139 [details]
Patch
Comment 8 j_pascoe@apple.com 2021-10-13 17:42:58 PDT
Created attachment 441167 [details]
Patch
Comment 9 Brent Fulgham 2021-10-15 15:59:03 PDT
Comment on attachment 441167 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=441167&action=review

> LayoutTests/ChangeLog:10
> +        in the WebAuthn layout tests.

Are any of these WebKit-specific tests covered by WPT tests?

> LayoutTests/http/wpt/webauthn/ctap-hid-success.https.html:-1
> -<!DOCTYPE html><!-- webkit-test-runner [ WebAuthenticationModernEnabled=true ] -->

Did you intend to deactivate the modern WebAuthn stuff in all of these tests? That seems unexpected for this patch.
Comment 10 John Wilander 2021-10-28 09:25:48 PDT
Can you explain in what cases sites need to use these credentials without a user gesture? There's is a tangible risk of allowing instant access to credentials.
Comment 11 John Wilander 2021-10-28 09:27:19 PDT
I remember being part of the discussion on why we added a user gesture requirement.
Comment 12 j_pascoe@apple.com 2021-10-28 10:03:46 PDT
Credentials can never be used without a user gesture (up=0, without user presence). This is for presenting the modal dialog where you can chose to select a key / insert an authenticator, after a given credential is chosen, there is still a test of user presence. Currently we require a user gesture to present this dialog, but you get a free try without it if you are Dropbox, Microsoft, Google, Twitter, or Facebook. 

The worry is about websites spamming modal dialogs to prevent users from changing tabs, etc. Unfortunately there's no pre-existing case of a webkit-only non-modal dialog for MacOS that I can find (even mini browser stuff uses NSAlert.)
Comment 13 John Wilander 2021-10-28 10:07:23 PDT
(In reply to j_pascoe@apple.com from comment #12)
> Credentials can never be used without a user gesture (up=0, without user
> presence). This is for presenting the modal dialog where you can chose to
> select a key / insert an authenticator, after a given credential is chosen,
> there is still a test of user presence. Currently we require a user gesture
> to present this dialog, but you get a free try without it if you are
> Dropbox, Microsoft, Google, Twitter, or Facebook. 
> 
> The worry is about websites spamming modal dialogs to prevent users from
> changing tabs, etc. Unfortunately there's no pre-existing case of a
> webkit-only non-modal dialog for MacOS that I can find (even mini browser
> stuff uses NSAlert.)

Thanks! Please rename the bug to make it clear in which context the user gesture requirement will be relaxed.

Regarding user presence. We need to make that clear too. A user can be present but passively so, right? I want to avoid drive-by redirects that can pick up credentials. We already have that problem with cookies which is a multi-year project to rein in.
Comment 14 j_pascoe@apple.com 2021-10-28 10:39:01 PDT
User presence in the context of WebAuthn is defined as "A test of user presence is a simple form of authorization gesture and technical process where a user interacts with an authenticator by (typically) simply touching it (other modalities may also exist), yielding a Boolean result." with an authorization gesture defined as "a physical interaction performed by a user with an authenticator as part of a ceremony, such as registration or authentication. By making such an authorization gesture, a user provides consent for (i.e., authorizes) a ceremony to proceed." 

So the case of a user passively present would not count. In the platform authenticator case with Face ID for example, a dialog is presented asking if it's okay for the website to use Face ID, hitting yes here is the test of user presence.

This bug refers to changing the behavior of what is required to present that dialog asking if its okay in the first place as its modal on iOS for example and if a site was able to spam it, they would not be able to change tabs or otherwise exit the website. Currently, we require a user gesture on the call to navigator.credentials.create() or navigator.credentials.get() as a way to prevent this. Unfortunately, few rps perform their call to navigator.credentials.create() or navigator.credentials.get() with a user gesture, leading to WebAuthn not working at all in most cases.

As a compromise, currently we allow one free use of navigator.credentials.create() or navigator.credentials.get() without an user gesture to present the Webauthn panel if the request comes from a short list of popular websites (Dropbox, Microsoft, Google, Twitter, or Facebook.) 

This bug is to change the current behavior to give all sites one freebie use of navigator.credentials.create() or navigator.credentials.get() to present the modal ui without an user gesture. Then if another call is made without a gesture, the user will be required to hit allow on a non-modal, pre-dialog to the current dialogs asking the user if they want to use WebAuthn.

Also, of note is that there is rumblings of adding non-modal ui for Webauthn to the spec in level 3 here: https://github.com/w3c/webauthn/issues/1545
Comment 15 j_pascoe@apple.com 2021-12-02 15:40:54 PST
Created attachment 445782 [details]
Patch
Comment 16 j_pascoe@apple.com 2021-12-03 13:47:59 PST
Created attachment 445893 [details]
Patch
Comment 17 j_pascoe@apple.com 2021-12-07 10:44:19 PST
Created attachment 446201 [details]
Patch
Comment 18 Brent Fulgham 2021-12-08 11:43:28 PST
Comment on attachment 446201 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=446201&action=review

lgtm. r+

> Source/WebKit/UIProcess/API/C/WKPageUIClient.h:1698
> +    WKPageRequestWebAuthenticationNoGestureCallback                   requestWebAuthenticationNoGesture;

Nit: Missing two spaces in front of requestWebAuthenticationNoGesture.
Comment 19 j_pascoe@apple.com 2021-12-08 12:40:48 PST
Created attachment 446411 [details]
Patch
Comment 20 j_pascoe@apple.com 2021-12-08 12:41:18 PST
Thank you for the review, addressed comments.
Comment 21 Brent Fulgham 2021-12-08 12:57:28 PST
Comment on attachment 446411 [details]
Patch

r=me
Comment 22 EWS 2021-12-09 09:54:42 PST
Committed r286785 (245026@main): <https://commits.webkit.org/245026@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 446411 [details].