https://www.mediawiki.org/wiki/Compatibility#Grade_C

Chrome 49+ (2016)
FF 49+ (2016)

https://caniuse.com/?search=webauthn

Chrome 67+ (2018)
FF 60+ (2018)

I wonder how many people are actually using a 9-10 year old browser, which I know is a different question...

An 8 year old browser, well, that's a different story ;)

To clarify, this is not about whether a browser supports WebAuthn. In a few years, all Grade C browsers support WebAuthn, but they would be denied login due to this bug, because we will have raised the Grade A bar for a different JavaScript feature elsewhere.

We don't load JS in Grade C browsers. Whether the WebAuth JS would work if it was loaded, is not in question.

See also T395347: Raise Grade A JavaScript requirement from ES2017 to ES2018 (ECMAScript 9) and T419142: Raise Grade A JavaScript requirement from ES2017 to ES2019 (ECMAScript 10).

Those are meant to be relatively trivial maintenance tasks with minimal impact, on the assumption that our platform is robust against loss of JavaScript. In return, developers get to use modern JS features quickly, don't have to test or support a long tail of older browsers, and can reason about a single version of the experience (i.e. not endless permutations and combinations of what does and doesn't work).

I'm using an old browser as an example here, but per https://www.mediawiki.org/wiki/Compatibility#Browsers this affects modern browsers as well:

The Modern layer […] may fail to load, arrive later, or not at all, including in modern browsers. This depends on various circumstances.

https://wikitech.wikimedia.org/wiki/MediaWiki_Engineering/Guides/Frontend_performance_practices#Getting_started

JavaScript adds optional layers that may or may not arrive. Its eventual arrival depends on numerous factors, and may vary over time even for the same person, including:

• […]
• intervention by browser vendors. […]
• server and network stability. […]
• network speed. […]
• interference by browser extension. […]

This affects the latest Firefox and Chrome as well, because JS may fail to arrive for any number of reasons.

Our policy lets us drop JavaScript support for browsers 3+ years old. We're behind on that part due to bugs like this one.

I can't reproduce this. When I try logging in with JS disabled it prints that error but still lets me log in despite showing it.

First attempt shows the error from the screenshot, but on retrying it works

On Firefox 56-57 works from first try, even though that warning Javascript must be enabled in your browser to use a security key is there

That warning should be fixed in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/1281397

Weird behaviour, on first "cold" login it fails and gives the warnings, even though the password is 100% correct, because I copy pasted it. It also asks to solve the word-captcha.
If you try to logout/login again afterwards it works just fine on first try.

Login is broken in Chrome 62

Looks like support for these old browsers was removed on purpouse in https://phabricator.wikimedia.org/T344791

Works on Chrome 67, broken in Chrome 64 and 66.

Change #1288873 had a related patch set uploaded (by Kosta Harlan; author: Kosta Harlan):

[mediawiki/extensions/OATHAuth@master] webauthn: Ship a Grade C login bundle via StandaloneModule

https://gerrit.wikimedia.org/r/1288873

Change #1288873 abandoned by Kosta Harlan:

[mediawiki/extensions/OATHAuth@master] webauthn: Ship a Grade C login bundle via StandaloneModule

Reason:

Not needed

https://gerrit.wikimedia.org/r/1288873