webauthn icon indicating copy to clipboard operation
webauthn copied to clipboard

Incorrect use of `options` variable in `create()` and `get()` definitions

Open emlun opened this issue 2 years ago • 0 comments

§5.1.3. Create a New Credential and §5.1.4. Use an Existing Credential to Make an Assertion both declare their options parameter as the Credential[Creation|Request]Options object inherited from CredMan:

options This argument is a CredentialCreationOptions object whose options.publicKey member contains a PublicKeyCredentialCreationOptions object [...]

Both also re-assign the options variable:

Let options be the value of options.publicKey.

But both then also reference options.signal, which is a member of Credential[Creation|Request]Options but not PublicKeyCredential[Creation|Request]Options:

If options.signal is present and aborted, throw the options.signal’s abort reason.

For correctness, we need to keep a reference to the options inherited from CredMan and either introduce a new variable for its options.pubKey attribute, or simply reference the WebAuthn-specific parameters using the options.pubKey prefix.

emlun avatar Jun 21 '22 13:06 emlun