PM-34840: bug: Allow related-origin passkey creation#6777
PM-34840: bug: Allow related-origin passkey creation#6777david-livefront merged 1 commit intomainfrom
Conversation
github-actions
Bot
added
app:password-manager
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6777 +/- ##
==========================================
+ Coverage 85.00% 85.61% +0.60%
==========================================
Files 971 871 -100
Lines 61312 60044 -1268
Branches 8647 8613 -34
==========================================
- Hits 52121 51409 -712
+ Misses 6190 5652 -538
+ Partials 3001 2983 -18
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Great job! No new security vulnerabilities introduced in this pull request |
| ?.id | ||
| ?.prefixHttpsIfNecessary() | ||
|
|
||
| val sdkOrigin = (requestedOrigin ?: createPublicKeyCredentialRequest.origin) |
There was a problem hiding this comment.
I thought about this some more from my previous suggestion: While this "works" to trick the SDK into not doing extra validation, it means that the generated clientDataJSON will look like {"origin":"https://rpId.com", ...} rather than {"origin":"https://relatedorigin.com", ...}, which means that the relying party loses information.
The correct thing to do is to fix this in the SDK. I think it's OK to move forward with this workaround, but maybe we should add a TODO to address that later?
There was a problem hiding this comment.
Agreed. Is there a ticket we can reference here?
david-livefront
force-pushed
the
PM-34840-related-origin-passkey-creation
branch
2 times, most recently
from
4a91210 to
83547fd
Compare
iinuwa
left a comment
iinuwa
left a comment
There was a problem hiding this comment.
LGTM, but this should be reviewed by someone else with more experience with the Android implementation than me to be sure.
| ?.prefixHttpsIfNecessary() | ||
|
|
||
| // We use the requested relying party for the basis of the origin for privileged apps to | ||
| // ensure that related-origin requests are process successfully. In the future, the SDK |
There was a problem hiding this comment.
⛏️
| // ensure that related-origin requests are process successfully. In the future, the SDK | |
| // ensure that related-origin requests are processed successfully. In the future, the SDK |
| ?.id | ||
| ?.prefixHttpsIfNecessary() | ||
|
|
||
| val sdkOrigin = (requestedOrigin ?: createPublicKeyCredentialRequest.origin) |
There was a problem hiding this comment.
Agreed. Is there a ticket we can reference here?
david-livefront
force-pushed
the
PM-34840-related-origin-passkey-creation
branch
from
83547fd to
4b4625f
Compare
|
Thanks @SaintPatrck & @iinuwa |
3 participants
🎟️ Tracking
PM-34840
📔 Objective
This PR pulls the requested origin for privileged apps (browsers) since they have already had their origin validated. This allows us to create passkeys from websites that use related-origins.