Fixed

Bug

Status Update

No update yet.

Description

ch...@google.com

created issue on behalf of sh...@gmail.com #1

Mar 5, 2025 01:27AM

Steps to reproduce the problem

Register resident key credentials against a website supporting WebAuthn on both the platform authenticator (iCloud Keychain), and on a HSK (e.g. tested with a yubikey).
On subsequent visit to the website, perform a modal navigator.credentials.get without supplying an allowCredentials list.
Observe that the iCloud Keychain passkey login prompt appears, but ignore it and tap the blinking HSK instead. Enter PIN, and retap the HSK.
Observe there is an error when the expected result is a successful login.

Problem Description

What I’ve discovered from the chrome://device-log is that at the CTAP layer, the call to the HSK is being populated with an allowCredentials list containing the credential ID of the iCloud Keychain credential, which of course the HSK cannot honour. There should not have been an allowCredentials list injected into the CTAP message.

Summary

WebAuthn API injects allowCredentials list to CTAP when no allowCredentials supplied

Custom Questions

Which component does this fall under?

Blink>SecurityFeature

Does this work in other browsers?

Yes - This is just a Chrome problem

Additional Data

Category: API
Chrome Channel: Stable
Regression: Yes

Comments

an...@google.com <an...@google.com> #2Mar 5, 2025 01:41AM

I notice the same issue and LogCat shows the following message:
Google Play services out of date. Requires 3159100 but found 3136130

ss...@google.com <ss...@google.com> #3Mar 5, 2025 01:51PM

Same here.

"Google Play services out of date. Requires 3159100 but found 3136130"

400761095-M133.png

47 KB

View

Download

bb...@google.com <bb...@google.com> Mar 5, 2025 08:01PM

Assigned to de...@google.com.

ns...@chromium.org <ns...@chromium.org> Mar 5, 2025 08:02PM

Reassigned to ke...@chromium.org.

bb...@google.com <bb...@google.com> #4Mar 5, 2025 08:04PM

me as well....
Google Play services out of date. Requires 3159100 but found 3136130

bb...@google.com <bb...@google.com> #5Mar 5, 2025 08:04PM

I was hopeful that the release of API 18 (4.3) would have created a solution to this, unfortunately it includes version 3158130

jb...@yubico.com <jb...@yubico.com> #6Mar 7, 2025 03:36PM

Having the same issue:

07-25 00:03:54.998: W/GooglePlayServicesUtil(27293): Google Play services out of date. Requires 3159100 but found 3158130

Screen Recording 2025-03-06 at 18.27.31.mov

29 MB

Download

dx...@google.com <dx...@google.com> #7Mar 14, 2025 10:17PM

Marked as fixed.

same

IssueTracker

This issue is a part of the Chromium tracker.

WebAuthn API injects allowCredentials list to CTAP when no allowCredentials supplied

Status Update

Description

Steps to reproduce the problem

Problem Description

Summary

Custom Questions

Which component does this fall under?

Does this work in other browsers?

Additional Data

Comments

an...@google.com <an...@google.com> #2Mar 5, 2025 01:41AM

ss...@google.com <ss...@google.com> #3Mar 5, 2025 01:51PM

bb...@google.com <bb...@google.com> Mar 5, 2025 08:01PM

ns...@chromium.org <ns...@chromium.org> Mar 5, 2025 08:02PM

bb...@google.com <bb...@google.com> #4Mar 5, 2025 08:04PM

bb...@google.com <bb...@google.com> #5Mar 5, 2025 08:04PM

jb...@yubico.com <jb...@yubico.com> #6Mar 7, 2025 03:36PM

dx...@google.com <dx...@google.com> #7Mar 14, 2025 10:17PM

Issue 400761095

Description

Steps to reproduce the problem

Problem Description

Summary

Custom Questions

Which component does this fall under?

Does this work in other browsers?

Additional Data

Issue summary

Comments

an...@google.com <an...@google.com> #2Mar 5, 2025 01:41AM

ss...@google.com <ss...@google.com> #3Mar 5, 2025 01:51PM

bb...@google.com <bb...@google.com> Mar 5, 2025 08:01PM

ns...@chromium.org <ns...@chromium.org> Mar 5, 2025 08:02PM

bb...@google.com <bb...@google.com> #4Mar 5, 2025 08:04PM

bb...@google.com <bb...@google.com> #5Mar 5, 2025 08:04PM

jb...@yubico.com <jb...@yubico.com> #6Mar 7, 2025 03:36PM

dx...@google.com <dx...@google.com> #7Mar 14, 2025 10:17PM

Add comment

Issue metadata