IssueTracker

Component used: Official documentation on "Authenticate user with Webview" -  https://developer.android.com/identity/sign-in/credential-manager-webview

Version used: The above document as last updated on 2024-05-28 UTC. Code from the examples https://github.com/android/identity-samples/blob/main/CredentialManagerWebView/CredentialManagerHandler.kt

How to reproduce: I create a passkey in the device inside our app (WebView). I can the create another one. The second invocation of the create has as an effect to substitute the existing credential in the authenticator with a new one. On the server side (RP) we have an additional credential. Of course only the newer works. Debugging the app, at the CredentialManagerHander createPasskey (https://github.com/android/identity-samples/blob/main/CredentialManagerWebView/CredentialManagerHandler.kt) the request has the ExcludedCredential table, with the entries expected, but the public key is empty. The RP sends valid values, as this works on all platform and also on the Android's Chrome. I have tested it with android chrome and it works as expected. The authenticator in this case rejects the credential creation as it holds an existing credential.

It seems that the injected javascript does not parse correctly these values. (The injected javascript: https://github.com/android/identity-samples/blob/main/CredentialManagerWebView/javascript/encode.js)

Devices/Android versions reproduced on:
It is in a bug in the javascript code that acts as a bridge between Webview and the Credentials Manager


How I fixed it:
I fixed the double registration error, by adding to the injected javascript (encode.js) at the "create" function this code:

if (temppk.hasOwnProperty('excludeCredentials')) {
const excludeCredentials = temppk.excludeCredentials;

        // Map over each item in the excludeCredentials array and check if it's a public key credential
        temppk.excludeCredentials = excludeCredentials.map((item, index) => {
          if (item.hasOwnProperty('id')) {
            // If it's an object with a rawId property, just encode its value as Base64
            item.id = CM_base64url_encode(item.id);
          } else if (item.hasOwnProperty('type')){
            item.type = item.type;
          }
          return item;
        });
      }
this checks the values of the excludeCredentials and encodes the id to base64. So the javascript bridge passes correctly the excludedCredentials to Credential manager. To integrate this fix, minify the updated encode.js and set it at the PasskeyWebListener.kt as the INJECTED_VAL

kind regards,
Sakis