Re: Heads up on (very) minor breaking change in WebAuthn/SPC error types

*If you don't have/own code that creates 'payment' WebAuthn credentials in
a cross-origin iframe, you can stop reading now.*

Hi folks,

Just a quick follow-up to announce: the change of error codes *will ship
in Chrome M137*, which will go to Beta around April 30th, and Stable around
May 27th.

As before, we expect the risk of breakage here to be small, but please let
us know ASAP if this will break you and you cannot adapt to the change!

Thanks,
Stephen

On Mon, 24 Feb 2025 at 10:49, Stephen McGruer <smcgruer@google.com> wrote:

> *If you don't have/own code that creates 'payment' WebAuthn credentials in
> a cross-origin iframe, you can stop reading now.*
>
> Hey folks,
>
> Just a heads up that Chromium is looking at
> <https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/X0c08UCiUGc>
> making a technically-breaking change in a very niche space: the error type
> thrown by navigator.credentials.create() if it is called in a cross-origin
> iframe without a user activation (e.g., click), with the 'payment'
> extension specified.
>
> This is being done to align with WebAuthn (see
> https://github.com/w3c/secure-payment-confirmation/issues/267). We do not
> expect this to break anyone, unless you had code that very specifically
> attempts to handle the error type thrown by navigator.credentials.create():
>
> try {
>   const publicKey = {
>     // A PublicKeyCredentialCreationOptions dict, with...
>     extensions: {
>       payment: {
>         isPayment: true;
>       }
>     }
>   };
>   const credential = await navigator.credentials.create({publicKey});
> } catch (e) {
>   if (e.name === "SecurityError") {
>     // Do something very specific
>   } else {
>     // Do something else
>   }
> }
>
> If you do have such code, please update it to handle both NotAllowedError
> and SecurityError, and get in touch with us to let us know that you would
> be affected.
>
> *We intend to target the change to M136*, which would be in Beta around
> Apr 2, 2025 and ship to Stable around Apr 29, 2025.
>
> Thanks,
> Stephen
>
> --
> smcgruer • he / him
>


-- 
smcgruer • he / him