Bug 311725
| Summary: | CredentialsContainer::get(): credential type combination check is incomplete — only validates publicKey and digital | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Marcos Caceres <marcosc> |
| Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | 310788 | ||
| Bug Blocks: | 268516 | ||
Marcos Caceres
The combination check added in bug 310788 (PR #62231) only validates publicKey/digital combinations. It does not correctly handle combinations involving password, federated, identity, or otp.
Per https://github.com/w3c/webappsec-credential-management/pull/261, the registry defines "Types allowed in the same get() request":
digital → empty (cannot mix with any other type)
federated → password only
identity → empty
otp → empty
password → federated only
publicKey → empty
The spec algorithm says (verbatim):
"If |type1|'s types allowed in the same get() request doesn't contain |type2|, then return a promise rejected with a NotSupportedError DOMException."
Current bugs:
1. { publicKey: {...}, password: true } — should NotSupportedError, but currently passes and silently ignores password.
2. { digital: {...}, password: true } — same problem.
3. { password: true, federated: {...} } — valid combo per spec, but we reject with "Missing request type" since we only look for publicKey/digital.
4. { password: true } alone — valid (if unimplemented) type, but we reject with "Missing request type".
Fix: validate all combinations against the registry table. For unimplemented types (password, federated, identity, otp), return null rather than "Missing request type".
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/174313024>
Marcos Caceres
Fixed by 906bdfad2925 (bug 310788, "Cred Man: Define which types are allowed in the same get() request"). checkCredentialTypeCombinations() now validates all six credential types (password, federated, identity, otp, publicKey, digital) against the Credential Management type registry, and all four reported combinations behave correctly. Note: the !ENABLE(WEB_AUTHN) fallback branch still uses the old publicKey-only check — immaterial to ports that ship WebAuthn, but a valid separate follow-up if non-WebAuthn ports matter.