neutralinojs / webview

A modified version of C++ webview for Neutralinojs.
MIT License
10 stars 1 forks source link

navigator.credentials is broken in 'window' mode (chrome/browser mode is ok) #26

Open fix opened 1 year ago

fix commented 1 year ago

Describe the bug On macosx (not tested on other plateform though, but might be the same issue), navigator.credentials existing but does not work properly when navigator.credentials.create({publicKey:{...}}) is called To Reproduce open the inspector and type:

navigator.credentials.create({
  publicKey:{<your payload>}})

Note this is NOT due to window not focused (an issue in itself on applewebkit), before you asked, i have checked this is not the issue

The error raised is NotAllowedError: Operation failed

Expected behavior Normally when navigator.credentials.create is called, a special nativve pop up is displayed offering the user to choose which Fido2 credentials to use (if you try in safari or other browser this is what happens).

Specifications

Additional context I believe the credentials connector bindings to native MacosX (and likely other OS) UI for FIDO2 management is not shipped with the executable.

fix commented 1 year ago

I have checked on webview repository and there is a warning in the README saying

it does not attempt to support user interaction features like alert(), confirm() and prompt() and other non-essential features like console.log()

navigator.credentials do need user interaction (usually a popup requesting to select a fido2 device and asking user to enter a pin)

I guess there is no way this can change. The only way then to be independant from web view would be to bind navigator.credentials to opensourc libfido2. The dependencies could be distributed independently

I have unfortunately very little knowledge of C so right now i am using Neutralino.os.execCommand to run the libfido2 utilities. If somebody can bind it directly in some kind of Neutralino.custom.credentials.create and Neutralino.custom.credentials.get I would be happy to pay for it.