Not Allowed Error

[rogue-kitten]

• Implementing a basic sign in flow based on the examples in the repo, but getting the following error:

App.tsx:113 Error NotAllowedError: The operation either timed out or was not allowed. See: https://www.w3.org/TR/webauthn-2/#sctn-privacy-considerations-client.
    at identifyAuthenticationError (index.js:266:16)
    at startAuthentication (index.js:331:15)
    at async onLogin (App.tsx:96:27)

Suprising this flow was working like about an hour ago, and then I just tried to check it again, but I am getting this error. What could be the possible reasons for this error? And how should i go about fixing this?

[MasterKale]

You'll want provide a lot more info before anyone can help. OS, browser, and probably some code since it looks like you're writing a single-page app. A basic reproduction repo, a Codepen, etc... is nice too, if possible.

[craigbroadbear]

I get that error too, startAuthentication() throwing an exception, running on windows 11, using chrome and edge. On Using firefox, I get the error "UnknownError: The authenticator was unable to process the specified options, or could not create a new assertion signature"

The parameter to startAuthentication is:
{
"challenge": "BP0pJRnUnX5qjknjYOqL5blBkkKvxhjUatbEexUPVik",
"allowCredentials": [
{
"id": "",
"type": "public-key"
}
],
"timeout": 300000,
"userVerification": "preferred",
"rpId": "localhost"
}

Note the "id" is empty - server side the "generateAuthenticationOptions()" nuked it.

[MasterKale]

Huh, how were you specifying that ID when calling the method? Can you provide an example invocation of generateAuthenticationOptions() that generated that empty string for the credential ID?

[craigbroadbear]

This is what I pass to "generateAuthenticationOptions()" on the server:

{
  "rpID": "localhost",
  "allowCredentials": [
    {
      "id": "PPFVInmFQ8cS5a41YL80etb2fcliXQ3YLo7yNl4+RGg=",
      "type": "public-key"
    }
  ],
  "userVerification": "preferred",
  "timeout": 300000
}

And this is what is returned from generateAuthenticationOptions():

{
  "challenge": "phbM-b-wwken0iiY8-MdTU7fNVDmmtYAcycxZx6--Jo",
  "allowCredentials": [
    {
      "id": "",
      "type": "public-key"
    }
  ],
  "timeout": 300000,
  "userVerification": "preferred",
  "rpId": "localhost"
}

[craigbroadbear]

Just had a look at generateAuthenticationOptions code, it appears its wants the credential id to be a buffer, not a base64 encoded string. So that fixes that issue, on to the next problem!

[lil5]

Was this fixed in the SimpleWebAuthn code, or did you need a workaround?

[craigbroadbear]

I needed to convert my base64 strings to Buffers. The code I use looks something like this:

 const creds = user.authenticators.map(a => ({id: Buffer.from(a.credentialID, 'base64url'), type: 'public-key'}));
    const rpID = config.authDomain()
    let opts = {
        rpID,
        allowCredentials: creds,
        userVerification: 'preferred',
        timeout: config.timeout,
    };
    const authOptions = await generateAuthenticationOptions(opts);