Skip to content

Remove mediation: 'silent' when logging in with Webauthn#63230

Merged
ravicious merged 1 commit intomasterfrom
r7s/firefox-webauthn
Jan 28, 2026
Merged

Remove mediation: 'silent' when logging in with Webauthn#63230
ravicious merged 1 commit intomasterfrom
r7s/firefox-webauthn

Conversation

@ravicious
Copy link
Copy Markdown
Member

@ravicious ravicious commented Jan 28, 2026

Closes #63231

changelog: Fixed a CredentialContainer error when attempting to log in to the Web UI with a hardware key using Firefox >=147.0.2

Firefox 147.0.2 seems to have removed support for mediation: 'silent' and now returns a hard error when our code tries to use Webauthn ("CredentialContainer request is not supported").

It's unclear why we had this option in the first place. It was added in a PR that was not strictly related to Webauthn, gravitational/webapps#1172, specifically commit 51de7add. Removing the option makes it possible to log in again.

The docs for the silent option say:

The user will not be asked to authenticate. The user agent will automatically reauthenticate the user and log them in if possible. If consent is required, the promise will fulfill with null. This value is intended for situations where you would want to automatically sign a user in upon visiting a web app if possible, but if not, you don't want to present them with a confusing login dialog box. Instead, you'd want to wait for them to explicitly click a "Login/Signup" button.

It doesn't seem like it's warranted in our case because the call to navigator.credentials.get is always gated behind a button click, so it's not like we call this API on page load.

@ravicious ravicious added this pull request to the merge queue Jan 28, 2026
Merged via the queue into master with commit 77a08d0 Jan 28, 2026
48 checks passed
@ravicious ravicious deleted the r7s/firefox-webauthn branch January 28, 2026 16:15
@backport-bot-workflows
Copy link
Copy Markdown
Contributor

@ravicious See the table below for backport results.

Branch Result
branch/v17 Create PR
branch/v18 Create PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Firefox: MFA with Security Key broken

3 participants