diff --git a/libs/common/src/platform/services/fido2/fido2-client.service.spec.ts b/libs/common/src/platform/services/fido2/fido2-client.service.spec.ts index 51c3d8617ab..4fd91fb19e6 100644 --- a/libs/common/src/platform/services/fido2/fido2-client.service.spec.ts +++ b/libs/common/src/platform/services/fido2/fido2-client.service.spec.ts @@ -92,6 +92,27 @@ describe("FidoAuthenticatorService", () => { }); describe("createCredential", () => { + describe("Mapping params should handle variations in input formats", () => { + it.each([ + [true, true], + [false, false], + ["false", false], + ["", false], + ["true", true], + ])("requireResidentKey should handle %s as boolean %s", async (input, expected) => { + const params = createParams({ + authenticatorSelection: { requireResidentKey: input as any }, + extensions: { credProps: true }, + }); + + authenticator.makeCredential.mockResolvedValue(createAuthenticatorMakeResult()); + + const result = await client.createCredential(params, windowReference); + + expect(result.extensions.credProps?.rk).toBe(expected); + }); + }); + describe("input parameters validation", () => { // Spec: If sameOriginWithAncestors is false, return a "NotAllowedError" DOMException. it("should throw error if sameOriginWithAncestors is false", async () => { diff --git a/libs/common/src/platform/services/fido2/fido2-client.service.ts b/libs/common/src/platform/services/fido2/fido2-client.service.ts index 2445cd366de..5d5f2a879cb 100644 --- a/libs/common/src/platform/services/fido2/fido2-client.service.ts +++ b/libs/common/src/platform/services/fido2/fido2-client.service.ts @@ -483,11 +483,15 @@ function mapToMakeCredentialParams({ type: credential.type, })) ?? []; + /** + * Quirk: Accounts for the fact that some RP's mistakenly submits 'requireResidentKey' as a string + */ const requireResidentKey = params.authenticatorSelection?.residentKey === "required" || params.authenticatorSelection?.residentKey === "preferred" || (params.authenticatorSelection?.residentKey === undefined && - params.authenticatorSelection?.requireResidentKey === true); + (params.authenticatorSelection?.requireResidentKey === true || + (params.authenticatorSelection?.requireResidentKey as unknown as string) === "true")); const requireUserVerification = params.authenticatorSelection?.userVerification === "required" ||