Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new error codes #2095

Open
wants to merge 16 commits into
base: main
Choose a base branch
from
Open

Add new error codes #2095

Changes from 3 commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
7d5d141
Add UserCancelledError
MasterKale Jul 11, 2024
d055e4c
Add HybridPrerequisitesError
MasterKale Jul 11, 2024
aee5232
Add TimeoutError
MasterKale Jul 11, 2024
7c45c45
Add UserHybridCancelledError
MasterKale Jul 12, 2024
35d7b3a
Replace "cancelled" with "cancellation"
MasterKale Jul 12, 2024
4dcbd9b
Add UserVerificationError
MasterKale Jul 12, 2024
0906982
Remove user cancellation from NotAllowedError
MasterKale Jul 12, 2024
6bd9757
Move where TimeoutError is raised
MasterKale Jul 16, 2024
c4140c7
Define new error interfaces
MasterKale Jul 18, 2024
4986178
Update error references to use new interfaces
MasterKale Jul 18, 2024
00baf08
Merge branch '1859-differentiate-errors' into 2062-new-error-codes
MasterKale Jul 23, 2024
17ff8f1
Remove duplicate TimeoutError
MasterKale Jul 30, 2024
d6ada58
Merge branch 'main' into 2062-new-error-codes
MasterKale Aug 28, 2024
09571b2
Remove hybrid errors for now
MasterKale Aug 28, 2024
0887054
Add required IDL for new error codes
MasterKale Aug 28, 2024
7aec744
Replace UserCancellationError with OptOutError
MasterKale Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 40 additions & 4 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1946,11 +1946,17 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
<dl class="switch">
: If |lifetimeTimer| expires,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
and [=set/remove=] |authenticator| from |issuedRequests|.
and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "[=create/TimeoutError=]" {{DOMException}}.
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

General feedback: this PR needs to update section 14, in particular 14.5.2

For example, one such information leak is if the client returns a failure response as soon as the user denies consent to proceed with an authentication ceremony . In this case the Relying Party could detect that the ceremony was canceled by the user and not the timeout, and thus conclude that at least one of the credentials listed in the allowCredentials parameter is available to the user.

This PR is making it possible to distinguish between these cases.

MasterKale marked this conversation as resolved.
Show resolved Hide resolved
MasterKale marked this conversation as resolved.
Show resolved Hide resolved

: If the user exercises a user agent user-interface option to cancel the process,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "{{NotAllowedError}}" {{DOMException}}.
and [=set/remove=] |authenticator| from |issuedRequests|.

If the user agent is informing the user of an inability to continue the ceremony
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
due to missing {{AuthenticatorTransport/hybrid}} prerequisites,
throw a "[=create/HybridPrerequisitesError=]" {{DOMException}}.

Otherwise, throw a "[=create/UserCancelledError=]" {{DOMException}}.

: If <code>|options|.{{CredentialCreationOptions/signal}}</code> is present and [=AbortSignal/aborted=],
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=]
Expand Down Expand Up @@ -2245,6 +2251,10 @@ authorizing an authenticator. When <code>|options|.{{CredentialCreationOptions/m
: {{InvalidStateError}}
:: The authenticator used in the ceremony recognized an entry in {{PublicKeyCredentialCreationOptions/excludeCredentials}}
after the user [=user consent|consented=] to registering a credential.

: <dfn for="create">HybridPrerequisitesError</dfn>
:: The ceremony was cancelled due to missing prerequisites for use of
the {{AuthenticatorTransport/hybrid}} transport.

: {{NotSupportedError}}
:: No entry in {{PublicKeyCredentialCreationOptions/pubKeyCredParams}} had a {{PublicKeyCredentialDescriptor/type}} property of {{PublicKeyCredentialType/public-key}},
Expand All @@ -2254,13 +2264,21 @@ authorizing an authenticator. When <code>|options|.{{CredentialCreationOptions/m
:: The [=effective domain=] was not a [=valid domain=],
or <code>{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> was not equal to or a registrable domain suffix of the [=effective domain=].

: <dfn for="create">TimeoutError</dfn>
:: The ceremony was cancelled by the user agent after exceeding the time limit permitted for the ceremony.
See [[#sctn-timeout-recommended-range]] for more information.

: {{TypeError}}
:: The <code>|options|</code> argument was not a valid [[#sctn-credentialcreationoptions-extension|CredentialCreationOptions]] value,
or the value of <code>{{PublicKeyCredentialCreationOptions/user}}.{{PublicKeyCredentialUserEntity/id}}</code> was empty or was longer than 64 bytes.

: {{UnknownError}}
:: The [=authenticator=] could not process the supplied options,
or encountered an error while creating the new credential.

: <dfn for="create">UserCancelledError</dfn>
:: The user has exercised a user agent user-interface option
to end the ceremony.

: {{NotAllowedError}}
:: A catch-all error covering a wide range of possible reasons,
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
Expand Down Expand Up @@ -2460,11 +2478,17 @@ When this method is invoked, the user agent MUST execute the following algorithm

: If |lifetimeTimer| expires,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on
|authenticator| and [=set/remove=] |authenticator| from |issuedRequests|.
|authenticator| and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "[=get/TimeoutError=]" {{DOMException}}.
MasterKale marked this conversation as resolved.
Show resolved Hide resolved

: If the user exercises a user agent user-interface option to cancel the process,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "{{NotAllowedError}}" {{DOMException}}.
and [=set/remove=] |authenticator| from |issuedRequests|.

If the user agent is informing the user of an inability to continue the ceremony
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
due to missing {{AuthenticatorTransport/hybrid}} prerequisites,
throw a "[=get/HybridPrerequisitesError=]" {{DOMException}}.

Otherwise, throw a "[=get/UserCancelledError=]" {{DOMException}}.

: If <code>|options|.{{CredentialRequestOptions/signal}}</code> is present and [=AbortSignal/aborted=],
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
Expand Down Expand Up @@ -2783,16 +2807,28 @@ The steps for [=issuing a credential request to an authenticator=] are as follow
:: The ceremony was cancelled by an {{AbortController}}.
See [[#sctn-abortoperation]] and [[#sctn-sample-aborting]].

: <dfn for="get">HybridPrerequisitesError</dfn>
:: The ceremony was cancelled due to missing prerequisites for use of
the {{AuthenticatorTransport/hybrid}} transport.

: {{SecurityError}}
:: The [=effective domain=] was not a [=valid domain=],
or <code>{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> was not equal to or a registrable domain suffix of the [=effective domain=].

: <dfn for="get">TimeoutError</dfn>
:: The ceremony was cancelled by the user agent after exceeding the time limit permitted for the ceremony.
See [[#sctn-timeout-recommended-range]] for more information.

: {{TypeError}}
:: The <code>|options|</code> argument was not a valid [[#sctn-credentialrequestoptions-extension|CredentialRequestOptions]] value.

: {{UnknownError}}
:: The [=authenticator=] could not process the supplied options,
or encountered an error while generating an [=assertion signature=].

: <dfn for="get">UserCancelledError</dfn>
:: The user has exercised a user agent user-interface option
to end the ceremony.

: {{NotAllowedError}}
:: A catch-all error covering a wide range of possible reasons,
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
Expand Down