Do not insert "content/fido2/page-script.js" into all pages

bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).

Other

9.11k stars 1.21k forks source link

Steps To Reproduce

Open https://example.com

Expected Result

There is no FIDO script inserted by Bitwarden.

Actual Result

The <head> contains the following script.

<script src="chrome-extension://nngceckbapebfimnlniiiahkandclblb/content/fido2/page-script.js"></script>

Screenshots or Videos

No response

Additional Context

Including the FIDO page script into the DOM changes how the navigator.credentials.create API behaves.

For example, running the following code results in a different error with the Bitwarden script.

navigator.credentials.create({
    publicKey: {}
});

The FIDO script should only be included if the user opts in to use the Passkeys feature with Bitwarden. There is no reason to include it if the user isn't going to use Passkeys.

Operating System

Windows

Operating System Version

No response

Web Browser

Chrome

Browser Version

No response

Build Version

2023.10.2

Issue Tracking Info

[x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Hi @ThomasOrlita,

Your issue appears to be describing the intended behaviour of the software. If you want this to be changed, it would be a feature request.

We use GitHub issues as a place to track bugs and other development related issues. The Bitwarden Community Forums has a Feature Requests section for submitting, voting for, and discussing requests like this one: https://community.bitwarden.com/c/feature-requests/

Please sign up on our forums (https://community.bitwarden.com/signup) and search to see if this request already exists. If so, you can vote for it and contribute to any discussions about it. If not, you can re-create the request there so that it can be properly tracked.

Please note that a toggle to globally disable Passkey interactions in the browser extension will be available in an upcoming release.

This issue will now be closed.

Thanks!

bitwarden / clients