Charlotte/Cinny 
charlotte
has someone worked with webauthn in here? i’m trying to test my code on localhost (rp_id localhost, allowed origin http://localhost:8080) but no matter what i do i am just getting the following error:
NotAllowedError: CredentialContainer request is not allowed.
2
0
2
Matthew Miller 
iamkale@infosec.exchange
@charlotte WebAuthn works fine in "secure contexts", of which http://localhost (with or without a custom port) is one of them.
What do your options look like that you're passing to one of the WebAuthn API methods?
1
0
1
Charlotte/Cinny
charlotte
@iamkale i’m passing https://thermalpaste.technogothic.net/p/J69pXI.json to navigator.credentials.create (with user.id and challenge being an ArrayBuffer instead of base64 strings, this is just what the server is returning) and the error occurs both when calling the method from wasm or the dev console
I also tried the code on https://webauthn.guide/ with the rp id adjusted, which failed with the same error
1
0
0
Matthew Miller
iamkale@infosec.exchange
@charlotte This is jumping out to me:
...and the error occurs both when calling the method from wasm or the dev console...
You'll have a better time with WebAuthn if you switch to Chrome (which allows making WebAuthn calls from the dev console), or from within a <script> tag on the page in all browsers. And calling navigator.credentials via WASM is right out as it doesn't have access to where all the credential magic happens in the main JS thread.
TIL Firefox won't let you make a WebAuthn request from the dev console, interesting choice.
Anyway if you want to have an easier time playing around with WebAuthn then my suggestion is to wire up basic UI in an HTML document to make the WebAuthn calls, or switch to Chrome and use its dev console if you just want to copy-paste-execute JS commands.
1
0
0
Matthew Miller
iamkale@infosec.exchange
...wasm is in fact calling navigator.credentials.create using autogenerated bindings. That code is being executed just fine
Oh, intriguing! I'd love to know more about your use of WASM here if you can share.
……Trying it in chromium it seems that my code asks for my authenticator pin which might be why it doesn’t work in firefox huh
Are you on macOS? Firefox on macOS has historically not been able to perform UV so that might be complicating things. CTAP2 support is coming soon though so there's that to look forward to.
2
0
0
Nina "Erina" Satragno 💫
nsa@hachyderm.io@charlotte @iamkale chrome will ask for a PIN if you set userVerification to "required", "preferred", or leave it unset and the key has a PIN set.
0
0
1
0
1
3