bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).
https://bitwarden.com
Other
9.09k stars 1.2k forks source link

WebAuthn conformance: Binary properties in responses should be `ArrayBuffer`s, not `Uint8Array`s #11079

Open msizanoen1 opened 3 weeks ago

msizanoen1 commented 3 weeks ago

Steps To Reproduce

  1. Create a passkey for Yandex
  2. Attempt to log into Yandex with passkey

Expected Result

Login succeeds

Actual Result

Login fails

Screenshots or Videos

No response

Additional Context

The WebAuthn specification clearly states that ArrayBuffer is used to represent binary properties in credential responses. However Bitwarden uses Uint8Array instead which is nonconformant and confuses certain applications that require the type of such properties to be ArrayBuffer specifically (e.g. Yandex, 1Password web app, etc.)

Code exhibiting nonconformant behavior: https://github.com/bitwarden/clients/blob/b0e0e71974d93b16df9f06fd5daf37e8470219f8/apps/browser/src/autofill/fido2/utils/webauthn-utils.ts#L61-L89 https://github.com/bitwarden/clients/blob/b0e0e71974d93b16df9f06fd5daf37e8470219f8/apps/browser/src/autofill/fido2/utils/webauthn-utils.ts#L123-L135

Operating System

Linux

Operating System Version

No response

Web Browser

Chrome

Browser Version

No response

Build Version

2024.9.0

Issue Tracking Info

Neonwarden commented 3 weeks ago

Hi there,

This has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!