<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>213895</bug_id>
          
          <creation_ts>2020-07-02 12:26:54 -0700</creation_ts>
          <short_desc>[WebAuthn] problem with uv = required for getAssertion</short_desc>
          <delta_ts>2020-08-11 11:59:52 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>Safari Technology Preview</version>
          <rep_platform>iPhone / iPad</rep_platform>
          <op_sys>Other</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>WORKSFORME</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>181943</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="login Llama">loginllama</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>jiewen_tan</cc>
    
    <cc>loginllama</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1668319</commentid>
    <comment_count>0</comment_count>
    <who name="login Llama">loginllama</who>
    <bug_when>2020-07-02 12:26:54 -0700</bug_when>
    <thetext>In iOS 14 developer beta
The authenticator has a pin set:

The Authenticator is attached over USB/Lightning.

If in WebAuthn uv is unset, or set to preferred authentication works as expected the user is prompted for a pin and the credential is asserted with uv=1 in authenticator data.
If in WebAuthn uv is set to discouraged authentication works as expected the user is not prompted for a pin and the credential is asserted with uv=0 in authenticator data.

If in WebAuthn uv is set to required, the user is prompted to insert and activate the security key.  After doing UP the dialogue is stuck until it times out.

NFC attachment seems to have the same issue. 

Strange preferred works but not required.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1668616</commentid>
    <comment_count>1</comment_count>
    <who name="login Llama">loginllama</who>
    <bug_when>2020-07-03 12:39:29 -0700</bug_when>
    <thetext>Doing some more testing I discovered that uv = required from the RP will work if the authenticator advertises support for internal uv in its getInfo.

There is not a one to one mapping between uv in webAuthn and the UV option in getAssertion.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1675534</commentid>
    <comment_count>2</comment_count>
    <who name="Jiewen Tan">jiewen_tan</who>
    <bug_when>2020-07-28 01:02:05 -0700</bug_when>
    <thetext>I have tried a Yubico Blue Security Key with PIN set, same model with no PIN, and a Feitian BioPass on https://webauthntest.azurewebsites.net with UV = required, and cannot reproduce. Can you suggest a more detailed way of reproducing the issue?</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>