WebAuthn: support Safari's restriction to gesture events

[acdha]

Currently the MFA signup process works for hardware tokens with Safari but not the integrated Touch ID/Face ID support Safari added in the 15.x releases. If you attempt to use that process on iOS 15.4 or macOS 12.4, the register button will cause this error message to be displayed:

This request has been cancelled by the user.

The JavaScript console reveals this:

User gesture is not detected. To use the WebAuthn API, call 'navigator.credentials.create' or 'navigator.credentials.get' within user activated events.

Speculating wildly (I have a dishwasher to unload), I believe this is the same issue as 18F/identity-idp#5132 and w3c/webauthn#1293.

[glyph]

I think I've seen this error and re-tried the process once or twice, but I have TouchID from my laptop and FaceID from my phone — the latter I think I added yesterday — both added in safari. I just logged in with the former before posting this. Is there some method of interaction where this would sometimes work?

[acdha]

I've only encountered it as a binary always/never-works situation. I'm also having some trouble reproducing this on different devices. Here's my test results currently:

1. iPhone (iOS 15.5): logins always worked using NFC keys or, later, device WebAuthn identity. Device registration failed with that “cancelled by the user“ error until I disabled the Firefox Focus content blocker.
2. M1 MBP (macOS 12.4, Safari 15.5): logins and registration using USB keys or device WebAuthn always worked
3. 2019 iMac (macOS 12.4, Safari 15.5): logins and registration using USB keys always worked. This machine does not have a Secure Element so it doesn't support device WebAuthn directly and the Safari 15 feature to use your nearby iPhone fails with the “cancelled by the user” error for this site (it works for other sites like login.gov or GitHub).

One thing I noticed is that registration page does load Google Tag Manager and Fastly Insights. I was wondering whether it was possible that some part of the registration flow is impacted if GTM fails to load because while the iMac does not have Firefox Focus it does have a hosts file blocking ad networks & malware sites.

[woodruffw]

I was wondering whether it was possible that some part of the registration flow is impacted if GTM fails to load because while the iMac does not have Firefox Focus it does have a hosts file blocking ad networks & malware sites.

That shouldn't be the case -- the entire WebAuthn flow should be present in JS that's on the same host/origin as the rest of PyPI.