webauthn
webauthn copied to clipboard
Incorrect use of `options` variable in `create()` and `get()` definitions
§5.1.3. Create a New Credential and §5.1.4. Use an Existing Credential to Make an Assertion both declare their options parameter as the Credential[Creation|Request]Options object inherited from CredMan:
options This argument is a
CredentialCreationOptionsobject whose options.publicKeymember contains aPublicKeyCredentialCreationOptionsobject [...]
Both also re-assign the options variable:
Let options be the value of options.
publicKey.
But both then also reference options.signal, which is a member of Credential[Creation|Request]Options but not PublicKeyCredential[Creation|Request]Options:
If options.
signalis present and aborted, throw the options.signal’s abort reason.
For correctness, we need to keep a reference to the options inherited from CredMan and either introduce a new variable for its options.pubKey attribute, or simply reference the WebAuthn-specific parameters using the options.pubKey prefix.