NEW298951
WebAuthn Signal API PublicKeyCredential.signalAllAcceptedCredentials() never resolves 
https://bugs.webkit.org/show_bug.cgi?id=298951
Summary WebAuthn Signal API PublicKeyCredential.signalAllAcceptedCredentials() never ...
Kostas
Reported 2025-09-16 07:30:58 PDT
We reported this here: https://bugs.webkit.org/show_bug.cgi?id=278339, but we are not sure if it might be overlooked since the issue is already marked as RESOLVED. Hey, we have tried this out in the current Safari Technology Preview, Release 216 (Safari 18.4, WebKit 20622.1.7.2) on macOS 15.3.1. Is it possible that the Promise returned from signalAllAcceptedCredentials does not resolve? This is our test code: // @ts-ignore if (!window.PublicKeyCredential || !window.PublicKeyCredential.signalAllAcceptedCredentials) { return undefined; } // @ts-ignore console.log('Running signalAllAcceptedCredentials'); try { // @ts-ignore await window.PublicKeyCredential.signalAllAcceptedCredentials({ rpId: rpId, userId: userId, allAcceptedCredentialIds: credentialIds, }); console.log('Signal all accepted credentials success'); } catch (e) { console.log('Signal all accepted credentials error', e); return; } What we observe: - signalAllAcceptedCredentials is not defined on PublicKeyCredential => "Running signalAllAcceptedCredentials" is being logged - neither "Signal all accepted credentials success" nor "Signal all accepted credentials error" are being logged => the signalAllAcceptedCredentials seems to block
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2025-09-23 07:31:20 PDT
<rdar://problem/161170398>
Matthew Miller (Cisco)
Comment 2 2025-11-03 16:28:29 PST
Chiming in at the start of November to report that this issue is still a problem as of Safari 26.0.1, as well as in Safari Technology Preview 231. The call _does_ lead to the deletion of a passkey that's stored in Passwords.app, but because the Promise doesn't resolve then nothing in `.then()/.catch()`, or `try/catch` with `await`, can run afterwards. Here's a basic HTML doc that can be used to replicate the problem: ```html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Document</title> </head> <body> <button id="promiseChain">Click to chain signal Promise</button> <button id="promiseAwait">Click to await signal Promise</button> <script> document.getElementById("promiseChain").addEventListener("click", () => { PublicKeyCredential.signalAllAcceptedCredentials({ rpId: "localhost", userId: "c2FmYXJp", allAcceptedCredentialIds: [], }) .then(() => { console.log("Called signalAllAcceptedCredentials()"); }) .catch(console.error); }); document.getElementById("promiseAwait").addEventListener("click", async () => { try { await PublicKeyCredential.signalAllAcceptedCredentials({ rpId: "localhost", userId: "c2FmYXJp", allAcceptedCredentialIds: [], }); console.log("Called signalAllAcceptedCredentials()"); } catch (err) { console.error(err); } }); </script> </body> </html> ```
Matthew Miller (Cisco)
Comment 3 2025-11-04 09:22:05 PST
A follow-up since, coincidentally, the 26.1 releases dropped this week. This problem still exists in macOS Safari 26.1.
Note You need to log in before you can comment on or make changes to this bug.