webauthn
webauthn copied to clipboard
Incorrect use of `options` variable in `create()` and `get()` definitions
§5.1.3. Create a New Credential and §5.1.4. Use an Existing Credential to Make an Assertion both declare their options parameter as the Credential[Creation|Request]Options
object inherited from CredMan:
options This argument is a
CredentialCreationOptions
object whose options.publicKey
member contains aPublicKeyCredentialCreationOptions
object [...]
Both also re-assign the options variable:
Let options be the value of options.
publicKey
.
But both then also reference options.signal
, which is a member of Credential[Creation|Request]Options
but not PublicKeyCredential[Creation|Request]Options
:
If options.
signal
is present and aborted, throw the options.signal
’s abort reason.
For correctness, we need to keep a reference to the options inherited from CredMan and either introduce a new variable for its options.pubKey
attribute, or simply reference the WebAuthn-specific parameters using the options.pubKey
prefix.