Bug 235421 – WebAuthn API Error message poorly written for missing pubKeyCredParams

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Justin Lowery]

Hello all,

After doing regression testing for our (ForgeRock) SDK and its WebAuthn implementation, we came across this error in Safari that was impossible to understand:

> No desired properties of the to be created credential are provided

The only thing that helped us figure out the underlying issue (after a Google search) was the code comment above this line of code in your Github repo: https://github.com/WebKit/webkit/blob/main/Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp#L143. I would like to suggest that this error message be rewritten to help others find the cause of the error.

Thanks,

Justin

[Radar WebKit Bug Importer]

<rdar://problem/87884875>

[[e-mail]]

Created attachment 452915 [details]
Patch

[[e-mail]]

Created attachment 452991 [details]
Patch

[Brent Fulgham]

Comment on attachment 452991 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=452991&action=review

> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:144
> +        promise.reject(Exception { NotSupportedError, "No desired properties of the to be created credential are provided (No valid values in options.pubKeyCredParams)."_s });

This message is strangely worded. Is it defined by a spec?

Actually, doesn't step 10 say [1]:

[... if options.pubKeyCredParams's size is zero]: "ero
Append the following pairs of PublicKeyCredentialType and COSEAlgorithmIdentifier values to credTypesAndPubKeyAlgs:

public-key and -7 ("ES256").
public-key and -257 ("RS256").

[1] "https://www.w3.org/TR/webauthn-2/#CreateCred-DetermineRpId

[Brent Fulgham]

Comment on attachment 452991 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=452991&action=review

>> Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp:144
>> +        promise.reject(Exception { NotSupportedError, "No desired properties of the to be created credential are provided (No valid values in options.pubKeyCredParams)."_s });
> 
> This message is strangely worded. Is it defined by a spec?
> 
> Actually, doesn't step 10 say [1]:
> 
> [... if options.pubKeyCredParams's size is zero]: "ero
> Append the following pairs of PublicKeyCredentialType and COSEAlgorithmIdentifier values to credTypesAndPubKeyAlgs:
> 
> public-key and -7 ("ES256").
> public-key and -257 ("RS256").
> 
> [1] "https://www.w3.org/TR/webauthn-2/#CreateCred-DetermineRpId

At any rate, maybe the message could be something like:

"Unable to create a credential because options.pubKeyCredParams is empty"?

[[e-mail]]

Created attachment 453021 [details]
Patch

[Brent Fulgham]

Comment on attachment 453021 [details]
Patch

r=me

[EWS]

Committed r290392 (247706@main): <https://commits.webkit.org/247706@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 453021 [details].

[Brent Fulgham]

This fix shipped with Safari 15.5 (all platforms).