NotAllowedError during registration

[james-d-elliott]

I'm looking at utilizing the browser element of the library and I am getting this error purely on Chrome (it works fine in Firefox, obviously via CTAP1 though):

NotAllowedError: User clicked cancel, or the registration ceremony timed out

I do not believe the error is related to this library but is probably something to do with go-webauthn, but I figured someone here may pick out the issue straight away. Here is the JSON options being fed into startRegistration in two scenarios both at the URL https://login.example.com:8080/webauthn/register. I have beautified everything other than pubKeyCredParams for the sake of readability.

Scenario 1 (Device Not Registered):

{
  "challenge": "UhrUOZnXGhUIr1SRtntiTo3-hXqC9ubXAiPUPXxVQ6s",
  "rp": {
    "name": "RP Name",
    "id": "login.example.com"
  },
  "user": {
    "name": "john",
    "displayName": "John Doe",
    "id": "am9obg"
  },
  "pubKeyCredParams":[{"type":"public-key","alg":-7},{"type":"public-key","alg":-35},{"type":"public-key","alg":-36},{"type":"public-key","alg":-257},{"type":"public-key","alg":-258},{"type":"public-key","alg":-259},{"type":"public-key","alg":-37},{"type":"public-key","alg":-38},{"type":"public-key","alg":-39},{"type":"public-key","alg":-8}],
  "authenticatorSelection": {
    "authenticatorAttachment": "cross-platform",
    "requireResidentKey": false,
    "userVerification": "preferred"
  },
  "timeout": 60000,
  "attestation": "indirect"
}

Scenario 2 (Device Already Registered In Firefox):

{
  "challenge": "K18r65S8HZo0zgYTh2n0FoboM7CXPg4eqlvGgI1k1NA",
  "rp": {
    "name": "RP Name",
    "id": "login.example.com"
  },
  "user": {
    "name": "john",
    "displayName": "John Doe",
    "id": "am9obg"
  },
  "pubKeyCredParams":[{"type":"public-key","alg":-7},{"type":"public-key","alg":-35},{"type":"public-key","alg":-36},{"type":"public-key","alg":-257},{"type":"public-key","alg":-258},{"type":"public-key","alg":-259},{"type":"public-key","alg":-37},{"type":"public-key","alg":-38},{"type":"public-key","alg":-39},{"type":"public-key","alg":-8}],
  "authenticatorSelection": {
    "authenticatorAttachment": "cross-platform",
    "requireResidentKey": false,
    "userVerification": "preferred"
  },
  "timeout": 60000,
  "excludeCredentials": [
    {
      "type": "public-key",
      "id": "-PpJkmttB53q_8kQM5upVBG1gLe2uHDqLb9gBPV95OQPYIV_l0RYjB-BZdqfrtGs0eq9ThS90JoVnZVDYWbEXw"
    }
  ],
  "attestation": "indirect"
}

[MasterKale]

Hearing that you're using @simplewebauthn/browser, there's a caveat that you should be aware of: I'm (now, regretfully) overwriting NotAllowedError messages with "User clicked cancel, or the registration ceremony timed out" here:

https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/browser/src/helpers/identifyAuthenticationError.ts#L38

This came up in a discussion the other day, where iOS Safari is returning "NotAllowedError: Operation failed." but browser was obfuscating that:

#350 (comment)

One thing you can do is attempt to verify the real message on whatever error Chrome is throwing. If you open up devtools, you can set a breakpoint on the code in browser that when it checks if ("NotAllowedError" === n.name), and then re-attempt the registration and peek at n to see what the real message is before my library overwrites it with "User clicked cancel, or the registration ceremony timed out":

Maybe that'll shed some light on why Chrome is failing this registration.

Alternatively you can open up chrome://device-log?refresh=5 in a new tab, attempt registration, and then look at the device log to see if maybe the security key is acting up. Perhaps you'll get lucky and spot an Error with a status code, like I do here when I attempt to re-register a security key:

I hope that helps...I'm curious now too.

[MasterKale]

Chrome just recently disabled WebAuthn on sites with TLS certificate issues, as of M110. That's probably why it's unexpected, it used to be fine:

https://lists.w3.org/Archives/Public/public-webauthn/2022Nov/0135.html

You can use a tool like mkcert locally to help get a local dev server served over a valid HTTPS connection but accessible to other intranet devices. I personally use certbot with the SimpleWebAuthn example server to pull this off, using its manual DNS-based verification flow:

sudo certbot -d dev.example.com --manual certonly --preferred-challenges dns

[MasterKale]

But now I'm definitely thinking I need to stop overwriting NotAllowedError message, the spec only defines a couple of uses of NotAllowedError but clearly platforms have seen fit to overload this particular error. I wish there was a "PlatformError" type that they'd use instead ☹️

[MasterKale]

Created #352 to capture ⬆️ this.

[james-d-elliott]

But now I'm definitely thinking I need to stop overwriting NotAllowedError message, the spec only defines a couple of uses of NotAllowedError but clearly platforms have seen fit to overload this particular error.

That or maybe including error.message in some way. But I lean towards not overriding it.

I wish there was a "PlatformError" type that they'd use instead

I can't say I deeply understand DOMExceptions or what browsers have to work with here. But if adding a PlatformError would be an issue maybe a well defined format to the message portion of the NotAllowedError or other DOMExceptions when the reason for the exception is non-normative. Unless maybe the message is blank in other situations?

[MasterKale]

I've just released @simplewebauthn/[email protected] that no longer interprets NotAllowedError's, so browser-specific issues like this one should be more readily obvious.