Page MenuHomePhabricator
Create Task
Maniphest T392587

Trying to register two identical WebAuthn keys fails without warning
Open, Needs TriagePublic
Actions

Description

Steps to reproduce:

  • Visit Special:OATHManage in Google Chrome
  • Add a new WebAuthn key
  • Select Google Password Manager > Continue > Create
  • Do the same one more time.

You end up with an error: Could not verify your key. Please start the registration process again

The actual error (logged to the console) is The user attempted to register an authenticator that contains one of the credentials already registered with the relying party.

The user-visible error is misleading as the error doesn't have anything to do with verifying the existing key.

Related Objects

Event Timeline

Tgr created this task.Apr 24 2025, 1:20 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 24 2025, 1:20 PM
Tgr added a comment.Apr 24 2025, 1:20 PM

(I tested this in incognito mode but don't think it matters.)

Tgr added a comment.Apr 24 2025, 1:23 PM

Not sure how easy it is to detect what's happening (the exception thrown by navigator.credentials is the very generic InvalidStateError). Would be nice to show the actual error message to the user, at least.

Related spec discussion: Can RPs assume that InvalidStateError for create() means an excludeCredentials match?

Reedy moved this task from Backlog to Bugs on the MediaWiki-extensions-OATHAuth board.Apr 29 2025, 4:15 PM
Tgr mentioned this in T399959: Assess and review existing tasks and patches related to supporting WE 4.6.2 2fa Multiple Authenticators work.Jul 28 2025, 9:54 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits