Okta 1145765 uber bug (#3995) (#4018)

Luxu2-Okta · web-flow · commit 6643fb64ae6d · 2026-04-30T18:45:36.000Z
OKTA-1168850 Okta 1145765 uber bug (#3995) OKTA-1145765 feat: add support for transports and hints - Adds support for transports and hints for WebAuthn - Localizes RP ID mismatch errors
diff --git a/package.json b/package.json
@@ -246,7 +246,7 @@
     "webpack-dev-server": "^4.15.2"
   },
   "dependencies": {
-    "@okta/okta-auth-js": "7.14.0",
+    "@okta/okta-auth-js": "7.14.2",
     "@sindresorhus/to-milliseconds": "^1.0.0",
     "@types/backbone": "^1.4.15",
     "@types/eslint-scope": "^3.7.3",
diff --git a/playground/mocks/data/idp/idx/authenticator-enroll-webauthn-custom.json b/playground/mocks/data/idp/idx/authenticator-enroll-webauthn-custom.json
@@ -97,6 +97,7 @@
           "authenticatorSelection": {
             "userVerification": "discouraged"
           },
+          "hints": ["security-key"],
           "u2fParams": {
             "appid": "http://idx.okta1.com:1802"
           }
diff --git a/playground/mocks/data/idp/idx/authenticator-enroll-webauthn-passkeys.json b/playground/mocks/data/idp/idx/authenticator-enroll-webauthn-passkeys.json
@@ -96,6 +96,7 @@
           "authenticatorSelection": {
             "userVerification": "discouraged"
           },
+          "hints": ["client-device"],
           "u2fParams": {
             "appid": "http://idx.okta1.com:1802"
           }
diff --git a/playground/mocks/data/idp/idx/authenticator-enroll-webauthn.json b/playground/mocks/data/idp/idx/authenticator-enroll-webauthn.json
@@ -213,6 +213,7 @@
           "authenticatorSelection": {
             "userVerification": "discouraged"
           },
+          "hints": ["security-key"],
           "u2fParams": {
             "appid": "http://idx.okta1.com:1802"
           }
diff --git a/playground/mocks/data/idp/idx/authenticator-verification-webauthn-custom.json b/playground/mocks/data/idp/idx/authenticator-verification-webauthn-custom.json
@@ -63,6 +63,7 @@
         "challengeData": {
           "challenge": "qjUCU0xoVe5QZ3-etDCD",
           "userVerification": "discouraged",
+          "hints": ["security-key"],
           "extensions": {
             "appid": "https://localhost:3000"
           }
diff --git a/playground/mocks/data/idp/idx/authenticator-verification-webauthn-passkeys.json b/playground/mocks/data/idp/idx/authenticator-verification-webauthn-passkeys.json
@@ -63,6 +63,7 @@
         "challengeData": {
           "challenge": "qjUCU0xoVe5QZ3-etDCD",
           "userVerification": "discouraged",
+          "hints": ["client-device"],
           "extensions": {
             "appid": "https://localhost:3000"
           }
diff --git a/playground/mocks/data/idp/idx/authenticator-verification-webauthn.json b/playground/mocks/data/idp/idx/authenticator-verification-webauthn.json
@@ -189,6 +189,7 @@
         "challengeData": {
           "challenge": "qjUCU0xoVe5QZ3-etDCD",
           "userVerification": "required",
+          "hints": ["security-key"],
           "extensions": {
             "appid": "https://localhost:3000"
           }
@@ -297,15 +298,17 @@
         "key": "webauthn",
         "id": "autwa6eD9o02iBbtv0g2",
         "authenticatorId": "aidtheidkwh282hv8g3",
-        "credentialId": "hpxQXbu5R5Y2JMqpvtE9Oo9FdwO6z2kMR-ZQkAb6p6GSguXQ57oVXKvpVHT2fyCR_m2EL1vIgszxi00kyFIX6w"
+        "credentialId": "hpxQXbu5R5Y2JMqpvtE9Oo9FdwO6z2kMR-ZQkAb6p6GSguXQ57oVXKvpVHT2fyCR_m2EL1vIgszxi00kyFIX6w",
+        "transports": ["usb", "nfc"]
       },
       {
         "displayName": "MacBook Touch ID",
         "type": "security_key",
         "key": "webauthn",
         "id": "autwa6eD9o02iBbtv0g2",
         "authenticatorId": "fwftheidkwh282hv8g3",
-        "credentialId": "7Ag2iWUqfz0SanWDj-ZZ2fpDsgiEDt_08O1VSSRZHpgkUS1zhLSyWYDrxXXB5VE_w1iiqSvPaRgXcmG5rPwB-w"
+        "credentialId": "7Ag2iWUqfz0SanWDj-ZZ2fpDsgiEDt_08O1VSSRZHpgkUS1zhLSyWYDrxXXB5VE_w1iiqSvPaRgXcmG5rPwB-w",
+        "transports": ["internal"]
       },
       {
         "displayName": "Okta Email",
diff --git a/src/v2/view-builder/views/IdentifierView.js b/src/v2/view-builder/views/IdentifierView.js
@@ -370,6 +370,12 @@ const Body = BaseForm.extend({
       .then((assertion) => {
         this.remediateWithAssertion(assertion, RemediationForms.LAUNCH_PASSKEYS_AUTHENTICATOR);
       }, (error) => {
+        if (webauthn.isRelyingPartyIdMismatchError(error)) {
+          const rpId = this.options.appState.get('webauthnAutofillUIChallenge')?.challengeData?.rpId;
+          const errorSummary = loc('signin.passkeys.error.rpIdMismatch', 'login', [rpId]);
+          this.model.trigger('error', this.model, this._generateErrorObject(errorSummary));
+          return;
+        }
         this._handleWebAuthnError(error);
       })
       .finally(() => {
diff --git a/src/v2/view-builder/views/webauthn/ChallengeWebauthnView.js b/src/v2/view-builder/views/webauthn/ChallengeWebauthnView.js
@@ -84,10 +84,15 @@ const Body = BaseForm.extend({
     const authenticatorEnrollments = this.options.appState.get('authenticatorEnrollments')?.value || [];
     authenticatorEnrollments.forEach((enrollement) => {
       if (enrollement.key === 'webauthn') {
-        allowCredentials.push({
+        const credential = {
           type: 'public-key',
           id: CryptoUtil.strToBin(enrollement.credentialId),
-        });
+        };
+        const transports = enrollement.transports ?? enrollement.profile?.transports;
+        if (Array.isArray(transports)) {
+          credential.transports = transports;
+        }
+        allowCredentials.push(credential);
       }
     });
     const challengeData = authenticatorData.contextualData.challengeData;
@@ -118,6 +123,21 @@ const Body = BaseForm.extend({
       });
       this.saveForm(this.model);
     }, (error) => {
+      // Override the default browser RP ID mismatch error in order to provide
+      // a more user friendly error and have it localized
+      if (webauthn.isRelyingPartyIdMismatchError(error)) {
+        this.model.trigger('error', this.model, {
+          responseJSON: {
+            errorSummary: loc(
+              'signin.passkeys.error.rpIdMismatch',
+              'login',
+              [authenticatorData.contextualData.challengeData.rpId]
+            )
+          }
+        });
+        return;
+      }
+
       // Do not display if it is abort error triggered by code when switching.
       // this.webauthnAbortController would be null if abort was triggered by code.
       if (this.webauthnAbortController) {
diff --git a/src/v2/view-builder/views/webauthn/EnrollWebauthnView.js b/src/v2/view-builder/views/webauthn/EnrollWebauthnView.js
@@ -12,10 +12,15 @@ function getExcludeCredentials(authenticatorEnrollments = []) {
   const credentials = [];
   authenticatorEnrollments.forEach((enrollement) => {
     if (enrollement.key === 'webauthn') {
-      credentials.push({
+      const credential = {
         type: 'public-key',
         id: CryptoUtil.strToBin(enrollement.credentialId),
-      });
+      };
+      const transports = enrollement.transports ?? enrollement.profile?.transports;
+      if (Array.isArray(transports)) {
+        credential.transports = transports;
+      }
+      credentials.push(credential);
     }
   });
   return credentials;
@@ -86,19 +91,31 @@ const Body = BaseForm.extend({
         publicKey: options,
         signal: this.webauthnAbortController && this.webauthnAbortController.signal
       }).then((newCredential) => {
+        // example data: ["nfc", "usb"]
+        const transports =
+          webauthn.processWebAuthnResponse(newCredential.response.getTransports, newCredential.response);
         this.model.set({
           credentials : {
             clientData: CryptoUtil.binToStr(newCredential.response.clientDataJSON),
             attestation: CryptoUtil.binToStr(newCredential.response.attestationObject),
-            // example data: ["nfc", "usb"]
-            transports: webauthn.processWebAuthnResponse(newCredential.response.getTransports, newCredential.response),
+            ...(transports !== null && { transports }),
             // example data: {"credProps":{"rk":true}}
             clientExtensions: webauthn.processWebAuthnResponse(newCredential.getClientExtensionResults, newCredential)
           }
         });
         this.saveForm(this.model);
       })
         .catch((error) => {
+          // Override the default browser RP ID mismatch error in order to provide
+          // a more user friendly error and have it localized
+          if (webauthn.isRelyingPartyIdMismatchError(error)) {
+            this.model.trigger('error', this.model, {
+              responseJSON: {
+                errorSummary: loc('signin.passkeys.error.SecurityError', 'login')
+              }
+            });
+            return;
+          }
           this.model.trigger('error', this.model, {responseJSON: {errorSummary: getMessageFromBrowserError(error)}});
         }).finally(() => {
           this.webauthnAbortController = null;
diff --git a/src/v3/package.json b/src/v3/package.json
@@ -54,7 +54,7 @@
     "@mui/material": "^5.8.5",
     "@okta/odyssey-design-tokens": "1.44.0",
     "@okta/odyssey-react-mui": "1.44.0",
-    "@okta/okta-auth-js": "7.14.0",
+    "@okta/okta-auth-js": "7.14.2",
     "altcha": "^1.4.2",
     "chroma-js": "^2.4.2",
     "cross-fetch": "^3.1.5",
diff --git a/src/v3/src/types/schema.ts b/src/v3/src/types/schema.ts
@@ -191,6 +191,11 @@ export type WebAuthNEnrollmentPayload = {
      * for a newly-created key pair.
      */
     attestation: string;
+    /**
+     * JSON-serialized array of transport types supported by the authenticator.
+     * Omitted if getTransports() is not supported by the browser.
+     */
+    transports?: string;
   }
 };
 
diff --git a/src/v3/src/util/webauthnUtils.test.ts b/src/v3/src/util/webauthnUtils.test.ts
@@ -20,7 +20,38 @@ import {
 } from '@okta/okta-auth-js';
 import { getMockCreateCredentialsResponse, getStubTransactionWithNextStep } from 'src/mocks/utils/utils';
 
-import { webAuthNAuthenticationHandler, webAuthNEnrollmentHandler } from '.';
+import { isRelyingPartyIdMismatchError, webAuthNAuthenticationHandler, webAuthNEnrollmentHandler } from '.';
+
+jest.mock('./locUtil', () => ({
+  loc: jest.fn().mockImplementation((key: string, _bundle: string, params?: unknown[]) => {
+    if (params?.length) {
+      return `${key}:${params.join(',')}`;
+    }
+    return key;
+  }),
+}));
+
+describe('isRelyingPartyIdMismatchError', () => {
+  it('should return true for a DOMException with name SecurityError and code 18', () => {
+    const error = new DOMException('RP ID mismatch', 'SecurityError');
+    expect(isRelyingPartyIdMismatchError(error)).toBe(true);
+  });
+
+  it('should return false for a regular Error', () => {
+    expect(isRelyingPartyIdMismatchError(new Error('SecurityError'))).toBe(false);
+  });
+
+  it('should return false for a DOMException with a different name', () => {
+    const error = new DOMException('not allowed', 'NotAllowedError');
+    expect(isRelyingPartyIdMismatchError(error)).toBe(false);
+  });
+
+  it('should return false for non-error values', () => {
+    expect(isRelyingPartyIdMismatchError(null)).toBe(false);
+    expect(isRelyingPartyIdMismatchError(undefined)).toBe(false);
+    expect(isRelyingPartyIdMismatchError('string')).toBe(false);
+  });
+});
 
 describe('WebAuthN Util Tests', () => {
   const transaction = getStubTransactionWithNextStep();
@@ -53,7 +84,11 @@ describe('WebAuthN Util Tests', () => {
           signatureData: 'ghi',
         } as WebauthnVerificationValues),
       ),
-      getAttestation: jest.fn(),
+      getAttestation: jest.fn().mockReturnValue({
+        id: 'test-id',
+        clientData: 'mock-client-data',
+        attestation: 'mock-attestation',
+      }),
     };
     OktaAuth.webauthn = mockedWebauthn;
   });
@@ -77,12 +112,39 @@ describe('WebAuthN Util Tests', () => {
     } as RawIdxResponse;
     const { credentials } = await webAuthNEnrollmentHandler(transaction);
 
-    expect(credentials.clientData).not.toBeUndefined();
-    expect(credentials.attestation).not.toBeUndefined();
+    expect(credentials.clientData).toBe('mock-client-data');
+    expect(credentials.attestation).toBe('mock-attestation');
+    expect(credentials.transports).toBeUndefined();
     expect(mockedWebauthn.buildCredentialCreationOptions).toHaveBeenCalled();
+    expect(mockedWebauthn.getAttestation).toHaveBeenCalled();
     expect(mockCredentialsContainer.create).toHaveBeenCalled();
   });
 
+  it('should return transports when getAttestation includes them', async () => {
+    mockedWebauthn.getAttestation = jest.fn().mockReturnValue({
+      id: 'test-id',
+      clientData: 'mock-client-data',
+      attestation: 'mock-attestation',
+      transports: '["usb","nfc"]',
+    });
+
+    transaction.nextStep = {
+      name: 'mock-step',
+      relatesTo: {
+        value: {
+          contextualData: { activationData: 'abc123' },
+        } as unknown as IdxAuthenticator,
+      },
+    };
+    transaction.rawIdxState = {
+      ...transaction.rawIdxState,
+      authenticatorEnrollments: { value: [{ credentialId: '123456' }] },
+    } as RawIdxResponse;
+    const { credentials } = await webAuthNEnrollmentHandler(transaction);
+
+    expect(credentials.transports).toEqual('["usb","nfc"]');
+  });
+
   it('should throw an error when browser credentials prompt is interrupted while enrolling with webauthn', async () => {
     mockCredentialsContainer.create = jest.fn().mockImplementationOnce(
       () => Promise.reject(new Error('NotAllowed')),
@@ -91,6 +153,15 @@ describe('WebAuthN Util Tests', () => {
     await expect(webAuthNEnrollmentHandler(transaction)).rejects.toThrow('NotAllowed');
   });
 
+  it('should throw localized SecurityError when credentials.create rejects with RP ID mismatch', async () => {
+    mockCredentialsContainer.create = jest.fn().mockRejectedValueOnce(
+      new DOMException('RP ID mismatch', 'SecurityError'),
+    );
+
+    await expect(webAuthNEnrollmentHandler(transaction))
+      .rejects.toThrow('signin.passkeys.error.SecurityError');
+  });
+
   it('should create clientData, authenticatorData, & signatureData parameters when authenticating with webauthn',
     async () => {
       transaction.nextStep = {
@@ -124,4 +195,28 @@ describe('WebAuthN Util Tests', () => {
 
     await expect(webAuthNAuthenticationHandler(transaction)).rejects.toThrow('NotAllowed');
   });
+
+  it('should throw localized rpIdMismatch error with rpId when credentials.get rejects with RP ID mismatch', async () => {
+    mockCredentialsContainer.get = jest.fn().mockRejectedValueOnce(
+      new DOMException('RP ID mismatch', 'SecurityError'),
+    );
+
+    transaction.nextStep = {
+      name: 'mock-step',
+      relatesTo: {
+        value: {
+          contextualData: {
+            challengeData: { rpId: 'example.okta.com' } as ChallengeData,
+          },
+        } as IdxAuthenticator,
+      },
+    };
+    transaction.rawIdxState = {
+      ...transaction.rawIdxState,
+      authenticatorEnrollments: { value: [{ credentialId: '123456' }] },
+    } as RawIdxResponse;
+
+    await expect(webAuthNAuthenticationHandler(transaction))
+      .rejects.toThrow('signin.passkeys.error.rpIdMismatch:example.okta.com');
+  });
 });
diff --git a/src/v3/src/util/webauthnUtils.ts b/src/v3/src/util/webauthnUtils.ts
diff --git a/src/v3/test/integration/webauthn-enroll.test.tsx b/src/v3/test/integration/webauthn-enroll.test.tsx
diff --git a/test/unit/spec/v2/view-builder/views/ChallengeWebauthnView_spec.js b/test/unit/spec/v2/view-builder/views/ChallengeWebauthnView_spec.js
diff --git a/test/unit/spec/v2/view-builder/views/EnrollWebauthnView_spec.js b/test/unit/spec/v2/view-builder/views/EnrollWebauthnView_spec.js
diff --git a/test/unit/spec/v2/view-builder/views/IdentifierView_spec.js b/test/unit/spec/v2/view-builder/views/IdentifierView_spec.js
diff --git a/yarn.lock b/yarn.lock

Original file line number	Diff line number	Diff line change
`@@ -97,6 +97,7 @@`
`97`	`97`	`"authenticatorSelection": {`
`98`	`98`	`"userVerification": "discouraged"`
`99`	`99`	`},`
	`100`	`+ "hints": ["security-key"],`
`100`	`101`	`"u2fParams": {`
`101`	`102`	`"appid": "http://idx.okta1.com:1802"`
`102`	`103`	`}`
Original file line number	Diff line number	Diff line change
`@@ -96,6 +96,7 @@`
`96`	`96`	`"authenticatorSelection": {`
`97`	`97`	`"userVerification": "discouraged"`
`98`	`98`	`},`
	`99`	`+ "hints": ["client-device"],`
`99`	`100`	`"u2fParams": {`
`100`	`101`	`"appid": "http://idx.okta1.com:1802"`
`101`	`102`	`}`
Original file line number	Diff line number	Diff line change
`@@ -213,6 +213,7 @@`
`213`	`213`	`"authenticatorSelection": {`
`214`	`214`	`"userVerification": "discouraged"`
`215`	`215`	`},`
	`216`	`+ "hints": ["security-key"],`
`216`	`217`	`"u2fParams": {`
`217`	`218`	`"appid": "http://idx.okta1.com:1802"`
`218`	`219`	`}`
Original file line number	Diff line number	Diff line change
`@@ -63,6 +63,7 @@`
`63`	`63`	`"challengeData": {`
`64`	`64`	`"challenge": "qjUCU0xoVe5QZ3-etDCD",`
`65`	`65`	`"userVerification": "discouraged",`
	`66`	`+ "hints": ["security-key"],`
`66`	`67`	`"extensions": {`
`67`	`68`	`"appid": "https://localhost:3000"`
`68`	`69`	`}`