Electron repro: WebAuthn request that needs a security-key PIN crashes the browser process on Linux

Starred Gists，GitHub Gist，即时分享代码、笔记与代码片段。关注

	fido-repro
	FIDO repro: touch the security key when it blinks

	const log = (m) => { console.log('[repro] ' + m); document.getElementById('s').textContent = m; };
	(async () => {
	const rp = { id: 'localhost', name: 'fido-repro' };
	const q = new URLSearchParams(location.search); const uv = q.get('uv') \|\| 'discouraged';
	log('mode: get userVerification=' + uv);
	const chal = () => crypto.getRandomValues(new Uint8Array(32));
	try {
	log('create: waiting for touch');
	const c = await navigator.credentials.create({ publicKey: { rp, user: { id: crypto.getRandomValues(new Uint8Array(16)), name: 'repro', displayName: 'repro' },
	challenge: chal(), pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
	authenticatorSelection: { residentKey: 'discouraged', userVerification: 'discouraged' }, attestation: 'none', timeout: 60000 } });
	log('create: ok');
	log('get: waiting for touch');
	await navigator.credentials.get({ publicKey: { rpId: rp.id, challenge: chal(), userVerification: uv,
	allowCredentials: [{ type: 'public-key', id: c.rawId }], timeout: 60000 } });
	log('get: ok');
	} catch (e) { log('rejected: ' + e.name + ': ' + e.message); }
	log('done');
	})();
	</script>

	// Minimal Electron WebAuthn-over-HID repro: serve a page on http://localhost and run create() then get().
	const { app, BrowserWindow } = require('electron');
	const http = require('http'), fs = require('fs'), path = require('path');
	const html = fs.readFileSync(path.join(__dirname, 'index.html'));
	app.whenReady().then(() => {
	const srv = http.createServer((_, res) => { res.setHeader('content-type', 'text/html'); res.end(html); }).listen(0, '127.0.0.1', () => {
	const win = new BrowserWindow({ width: 640, height: 240 });
	win.webContents.on('console-message', (e) => {
	const msg = e.message ?? arguments[2];
	console.log(`${new Date().toISOString().slice(11, 23)} ${msg}`);
	if (msg === '[repro] done') setTimeout(() => app.quit(), 500);
	});
	win.loadURL(`http://localhost:${srv.address().port}/${process.env.REPRO_QUERY \|\| ''}`);
	});
	});

{ "name": "fido-repro", "version": "0.0.0", "main": "main.js" }

添加评论

点踩

参与讨论

FIDO repro: touch the security key when it blinks