Re: [webauthn] Clarify the need for truly randomly generated challenges (aka challenge callback issue) (#1856)

Following WG call of 2023-06-28, I undertook to determine if its currently possible (at least on Chrome and Safari where conditional UI is supported) to use a setTimeout() method to occassionally fetch a new challenge and abort and then restart the autofill call to navigator.credentials.get().

It seems this does work ok, although in Safari each time that the new autofill call is invoked, the console log shows:
_User gesture is not detected. To use the WebAuthn API, call 'navigator.credentials.create' or 'navigator.credentials.get' within user activated events._
Despite this the autofill call works, and I can complete autofill login. 
Safari should probably not do this since a user activated event is not needed for the autofill call to work. FYI - @pascoej 


As a result, I don't think that servers have to support very long-lived challenges, and a period challenge refresh is practical. I am ok with abandoning this feature.

-- 
GitHub Notification of comment by sbweeden
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1856#issuecomment-1612099068 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 28 June 2023 21:00:39 UTC