Created attachment 457507 [details] Video reproducing the issue Safari Version 15.4 (17613.1.17.1.13) on macOS 12.3.1 enters a "disabled" state when `navigator.credentials.get()` is called with a security key credential (i.e. transports are set to "usb" and "nfc") in `allowCredentials`, but then the user interacts with a security key that does not match the credential. By "disabled" state I mean the window becomes almost completely unresponsive to left clicks, and right clicks bring up context menus with all options disabled. Additionally the red close button on the windows's "stoplights" turns grey and cannot be used to close the window. At this point the only way to close the window is to Force Quit out of Safari. See attached video for a demonstration, and screenshot for proof of Safari version. ## Reproduction: The issue can be reproduced with the following HTML + JavaScript hosted at http://localhost: ``` <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Safari Bug Repro - WebAuthn Authentication Browser Crash</title> </head> <body> <h1> Safari Bug Repro - WebAuthn Authentication Browser Crash </h1> <button id="startAuth">Authenticate</button> <h2>Context</h2> <p> A single credential with a random ID has been set to <strong>allowCredentials</strong> with security key transports <strong>"usb"</strong> and <strong>"nfc"</strong>. </p> <h2>Reproduction Steps</h2> <ol> <li> Click the <strong>Authenticate</strong> button above to call navigator.credentials.get(). </li> <li> Select <strong>Security Key</strong> from the WebAuthn browser modal. </li> <li> Interact with any available security key. </li> <li> Observe the browser becomes unresponsive to almost all input, and the close button in the upper-left enters a disabled state. </li> </ol> <script> document.getElementById('startAuth').addEventListener('click', async (event) => { event.preventDefault(); try { console.log('Calling navigator.credentials.get()'); const res = await navigator.credentials.get({ publicKey: { rpId: 'localhost', allowCredentials: [ { id: new Uint8Array(32).fill(1), type: "public-key", transports: ["usb", "nfc"] } ], challenge: new Uint8Array(32).fill(1), }, }); console.log('Response:', res); } catch (err) { alert(err); } }); </script> </body> </html> ```
Created attachment 457508 [details] Screenshot of Safari showing version
<rdar://problem/91708885>
Hi. Thank you for the report. This issue has been fixed in the 12.4 beta released last week.