search

passwordless-lib / fido2-net-lib

FIDO2 .NET library for FIDO2 / WebAuthn Attestation and Assertion using .NET
https://fido2-net-lib.passwordless.dev/
MIT License
1.19k stars 173 forks source link

The "timeout" is not work on FireFox browsers while doing Registration or Authentication #178

Open johnsmilee0611 opened 4 years ago

johnsmilee0611 commented 4 years ago

@abergs Issue description: the "timeout" is not work on Firefox browsers while doing Registration or Authentication

Reproduced on "Use as 2FA/MFA" tab: https://www.passwordless.dev/mfa#heroFoot

I waited for more than 2 minutes, seem like it's don't pop-up the timeout dialog like Chrome and Microsoft Edge

I tried to reproduce on Chrome and Microsoft Edge, they are worked as my expected. Here are the screenshots:

download download (1)

(This issue happens same for Authentication)

mackie1001 commented 4 years ago

Is this related to the timeout passed to the nagivator.credentials... API? If so I've experienced various inconsistencies around how that behaves across different browsers, especially in relation how errors are surfaced and also whether the call blocks. I don't think there's anything that can be done about it from the fido2-net-lib side though, including the samples.

johnsmilee0611 commented 4 years ago

Is this related to the timeout passed to the nagivator.credentials... API? If so I've experienced various inconsistencies around how that behaves across different browsers, especially in relation how errors are surfaced and also whether the call blocks. I don't think there's anything that can be done about it from the fido2-net-lib side though, including the samples.

Yes, sir. The timeout passed to the following option objects of the nagivator.credentials... API https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions/timeout https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialRequestOptions/timeout

MichaelGrafnetter commented 4 years ago

This is actually a bug in Windows 10 WebAuthn API itself, as it is ignoring the timeout, even if I pass it directly through WinAPI. Chrome apparently bypasses it by explicitly cancelling the operation. So this is IMO not an issue of fido2-net-lib.