Make userHandle response field optional #2560
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mohitc1
reviewed
Dec 23, 2024
common/src/main/java/com/microsoft/identity/common/internal/fido/WebAuthnJsonUtil.kt
Outdated
Show resolved
Hide resolved
mohitc1
approved these changes
Dec 26, 2024
iamgusain
reviewed
Jan 2, 2025
common/src/main/java/com/microsoft/identity/common/internal/fido/WebAuthnJsonUtil.kt
Show resolved
Hide resolved
iamgusain
approved these changes
Jan 2, 2025
Contributor
Author
|
I'm going to disable the assemble consumers part for the purpose of merging. Everything passed except for the MSAL stage, which seems to be failing due to a Native Auth unit test. |
melissaahn
added
the
Skip-Consumers-Check
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
The Windows app team found a bug while testing cross-device passkey auth: https://microsoft.visualstudio.com/OS/_workitems/edit/55529057
In the logs, I see that the first attempt fails due to the userHandle attribute being missing in the response from CredMan. We currently have this attribute set as required, since the server side had mentioned that this attribute was required for them, but looking at the official WebAuthN spec, userHandle is only required if allowCredentials is NOT provided. If it is (like in the first attempt) then userHandle is optional: https://w3c.github.io/webauthn/#iface-authenticatorassertionresponse
I've confirmed with Authenticator that they always do send userHandle, and our current thinking is that some middle layer (since this is cross-device auth) might be removing that value from the final response. I'm not sure why this might be the case, but this is perfectly fine according to the WebAuthN spec. Therefore, we will follow the spec as well and will not block the response on userHandle.