Firefox js-libp2p WebTransport connection rejected

[dhuseby]

Repos:

• libp2p/js-libp2p (js-v1.x and js-v2.x, browser: firefox)
• libp2p/go-libp2p (go-v0.38 through go-v0.45)

Transport: webtransport

Summary

Firefox browser builds (firefox-js-v1.x and firefox-js-v2.x) fail to establish WebTransport connections to any go-libp2p listener. The dialer reports "WebTransport connection rejected" during the ping test. Chromium and WebKit browser builds using the same js-libp2p versions pass these tests, so the issue is specific to Firefox's WebTransport implementation.

Failing tests (16)

firefox-js-v1.x as dialer (8):

• firefox-js-v1.x x go-v0.38 (webtransport)
• firefox-js-v1.x x go-v0.39 (webtransport)
• firefox-js-v1.x x go-v0.40 (webtransport)
• firefox-js-v1.x x go-v0.41 (webtransport)
• firefox-js-v1.x x go-v0.42 (webtransport)
• firefox-js-v1.x x go-v0.43 (webtransport)
• firefox-js-v1.x x go-v0.44 (webtransport)
• firefox-js-v1.x x go-v0.45 (webtransport)

firefox-js-v2.x as dialer (8):

• firefox-js-v2.x x go-v0.38 (webtransport)
• firefox-js-v2.x x go-v0.39 (webtransport)
• firefox-js-v2.x x go-v0.40 (webtransport)
• firefox-js-v2.x x go-v0.41 (webtransport)
• firefox-js-v2.x x go-v0.42 (webtransport)
• firefox-js-v2.x x go-v0.43 (webtransport)
• firefox-js-v2.x x go-v0.44 (webtransport)
• firefox-js-v2.x x go-v0.45 (webtransport)

Error output

Dialer (Firefox):

  ping test (dialer)
    1) should dial and ping

  0 passing (152ms)
  1 failing

  1) ping test (dialer)
       should dial and ping:
     WebTransport connection rejected

Listener (go): No errors. The go listener starts successfully and publishes its multiaddr. The rejection happens at the WebTransport/QUIC layer before the libp2p handshake.

Notes

• Chromium and WebKit browser builds with the same js-libp2p versions (v1.x, v2.x) pass these same tests, confirming the issue is Firefox-specific.
• The go listener uses self-signed certificates with certhash verification. Firefox may handle WebTransport certificate validation differently from Chromium/WebKit, potentially rejecting the self-signed certs or certhash parameters.
• All 8 go versions (v0.38-v0.45) are affected identically, ruling out a go version-specific issue.
• Firefox's WebTransport support is relatively newer than Chromium's and may have stricter or different certificate handling behavior.