Passkey authentication doesn't abort on signal

jwendland
jwendland
Community Member
in 1Password in the Browser

The Webauthn Spec specifies that a credential registration operation should be abortable. Native authentication prompts honor cancellation through an AbortSignal passed into navigator.credentials.create, the 1PW extension does not and stay opens even after abort has been called on the AbortController

I created a code sandbox to demonstrate the issue. Click "Register credential". A native auth prompt will close after 5s, the 1PW overlay will not. Note that for the native authentication prompt to work, the preview needs to be opened in its own tab, as the way code sandbox iframes the preview doesn't allow for credential creation.

This issue becomes a nuisance when the server uses expiring challenges, the user sits on the 1PW passkey creation prompt for a while, the challenge expires in the meanwhile, the user then confirms, and ends up with a dysfunctional local passkey.

1Password Version: 8.10.48
Extension Version: 8.10.48.25, 8.10.50.20
OS Version: macOS
Browser: Chrome, Brave