Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new error codes #2095

Open
wants to merge 16 commits into
base: main
Choose a base branch
from
Open

Add new error codes #2095

Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
7d5d141
Add UserCancelledError
MasterKale Jul 11, 2024
d055e4c
Add HybridPrerequisitesError
MasterKale Jul 11, 2024
aee5232
Add TimeoutError
MasterKale Jul 11, 2024
7c45c45
Add UserHybridCancelledError
MasterKale Jul 12, 2024
35d7b3a
Replace "cancelled" with "cancellation"
MasterKale Jul 12, 2024
4dcbd9b
Add UserVerificationError
MasterKale Jul 12, 2024
0906982
Remove user cancellation from NotAllowedError
MasterKale Jul 12, 2024
6bd9757
Move where TimeoutError is raised
MasterKale Jul 16, 2024
c4140c7
Define new error interfaces
MasterKale Jul 18, 2024
4986178
Update error references to use new interfaces
MasterKale Jul 18, 2024
00baf08
Merge branch '1859-differentiate-errors' into 2062-new-error-codes
MasterKale Jul 23, 2024
17ff8f1
Remove duplicate TimeoutError
MasterKale Jul 30, 2024
d6ada58
Merge branch 'main' into 2062-new-error-codes
MasterKale Aug 28, 2024
09571b2
Remove hybrid errors for now
MasterKale Aug 28, 2024
0887054
Add required IDL for new error codes
MasterKale Aug 28, 2024
7aec744
Replace UserCancellationError with OptOutError
MasterKale Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 71 additions & 8 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1965,7 +1965,15 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o

: If the user exercises a user agent user-interface option to cancel the process,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "{{NotAllowedError}}" {{DOMException}}.
and [=set/remove=] |authenticator| from |issuedRequests|.

If the user agent is informing the user that
the last used |authenticator| cannot collect [=user verification=] when
<code>|pkOptions|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code>
is set to {{UserVerificationRequirement/required}},
throw a "{{UserVerificationError}}" {{DOMException}}.
Comment on lines +1970 to +1974
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The equivalent error on the authenticator layer is error code equivalent to "ConstraintError", so I think that could be used here too?

This would lump this together with another ConstraintError thrown when authenticatorSelection.userVerification == "required" and mediation == "conditional", but that is also an error expressing that UV was required but couldn't be performed, so I think that can be okay?

Then we could also add a case to pass through error code equivalent to "ConstraintError" from the authenticator layer, like we do with InvalidStateError.


Otherwise, throw an "{{OptOutError}}" {{DOMException}}.

: If <code>|options|.{{CredentialCreationOptions/signal}}</code> is present and [=AbortSignal/aborted=],
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=]
Expand Down Expand Up @@ -2234,7 +2242,7 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
</dl>
</li>

1. Throw a "{{NotAllowedError}}" {{DOMException}}. In order to prevent information leak that could identify the
1. Throw a "{{TimeoutError}}" {{DOMException}}. In order to prevent information leak that could identify the
emlun marked this conversation as resolved.
Show resolved Hide resolved
user without [=user consent|consent=], this step MUST NOT be executed before |lifetimeTimer| has expired. See
[[#sctn-make-credential-privacy]] for details.

Expand Down Expand Up @@ -2280,9 +2288,19 @@ The following {{DOMException}} exceptions can be raised:
the [=client=] does not support [[#sctn-related-origins|related origin requests]]
or the [$related origins validation procedure$] failed.

: {{TimeoutError}}
:: The ceremony was cancelled by the user agent after exceeding the time limit permitted for the ceremony.
See [[#sctn-timeout-recommended-range]] for more information.

: {{UnknownError}}
:: The [=authenticator=] could not process the supplied options,
or encountered an error while creating the new credential.
Comment on lines +2295 to +2297
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think error code equivalent to "UnknownError" is actually passed through by the client operation, is it? I think it's currently only InvalidStateError that's passed through like that.


: {{UserVerificationError}}
:: The user was unable to complete [=user verification=] as required by the [=[RP]=].

: {{NotAllowedError}}
:: A catch-all error covering a wide range of possible reasons,
including common ones like the user canceling out of the ceremony.
:: A catch-all error covering a wide range of possible reasons.
Some of these causes are documented throughout this spec,
while others are client-specific.

Expand Down Expand Up @@ -2504,7 +2522,15 @@ When this method is invoked, the user agent MUST execute the following algorithm

: If the user exercises a user agent user-interface option to cancel the process,
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
and [=set/remove=] |authenticator| from |issuedRequests|. Throw a "{{NotAllowedError}}" {{DOMException}}.
and [=set/remove=] |authenticator| from |issuedRequests|.

If the user agent is informing the user that
MasterKale marked this conversation as resolved.
Show resolved Hide resolved
the last used |authenticator| cannot collect [=user verification=] when
<code>|pkOptions|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code>
is set to {{UserVerificationRequirement/required}},
throw a "{{UserVerificationError}}" {{DOMException}}.

Otherwise, throw an "{{OptOutError}}" {{DOMException}}.

: If <code>|options|.{{CredentialRequestOptions/signal}}</code> is present and [=AbortSignal/aborted=],
:: [=set/For each=] |authenticator| in |issuedRequests| invoke the [=authenticatorCancel=] operation on |authenticator|
Expand Down Expand Up @@ -2683,7 +2709,7 @@ When this method is invoked, the user agent MUST execute the following algorithm
1. Return |constructAssertionAlg| and terminate this algorithm.
</dl>

1. Throw a "{{NotAllowedError}}" {{DOMException}}. In order to prevent information leak that could identify the
1. Throw a "{{TimeoutError}}" {{DOMException}}. In order to prevent information leak that could identify the
emlun marked this conversation as resolved.
Show resolved Hide resolved
user without [=user consent|consent=], this step MUST NOT be executed before |lifetimeTimer| has expired. See
[[#sctn-assertion-privacy]] for details.

Expand Down Expand Up @@ -2838,9 +2864,19 @@ The following {{DOMException}} exceptions can be raised:
the [=client=] does not support [[#sctn-related-origins|related origin requests]]
or the [$related origins validation procedure$] failed.

: {{TimeoutError}}
:: The ceremony was cancelled by the user agent after exceeding the time limit permitted for the ceremony.
See [[#sctn-timeout-recommended-range]] for more information.

: {{UnknownError}}
:: The [=authenticator=] could not process the supplied options,
or encountered an error while generating an [=assertion signature=].

: {{UserVerificationError}}
:: The user was unable to complete [=user verification=] as required by the [=[RP]=].

: {{NotAllowedError}}
:: A catch-all error covering a wide range of possible reasons,
including common ones like the user canceling out of the ceremony.
:: A catch-all error covering a wide range of possible reasons.
Some of these causes are documented throughout this spec,
while others are client-specific.
</dl>
Expand Down Expand Up @@ -3707,6 +3743,33 @@ SHOULD be aborted.
See [WHATWG HTML WG Issue #2711](https://github.com/whatwg/html/issues/2711) for more details.


## WebAuthn Interfaces ## {#sctn-interfaces}

The subection below defines custom interfaces used throughout WebAuthn.

### Custom WebAuthn Exceptions ### {#iface-custom-webauthn-exceptions}

For descriptions of these exceptions,
please see [[#sctn-create-request-exceptions]] and [[#sctn-get-request-exceptions]].

<xmp class="idl">
[Exposed=Window, Serializable]
interface UserVerificationError : DOMException {
constructor(optional DOMString message = "");
};
</xmp>

The <code>new UserVerificationError(|message|)</code> constructor steps are:

1. Set [=this=]'s {{DOMException/name}} to `"UserVerificationError"`.
1. Set [=this=]'s {{DOMException/message}} to `message`.

{{UserVerificationError}} objects are [=serializable objects=].

Their [=serialization steps=], given |value| and |serialized|, are to run the {{DOMException}} [=serialization steps=] given |value| and |serialized|.

Their [=deserialization steps=], given |serialized| and |value|, are to run the {{DOMException}} [=deserialization steps=] given |serialized| and |value|.

## WebAuthn Extensions Inputs and Outputs ## {#sctn-extensions-inputs-outputs}

The subsections below define the data types used for conveying [=WebAuthn extension=] inputs and outputs.
Expand Down