v135 · javascript

Align error type thrown for 'payment' WebAuthn credential creation: SecurityError => NotAllowedError

Correct the error type thrown during WebAuthn credential creation for 'payment' credentials. Due to a historic specification mismatch, creating a 'payment' credential in a cross-origin iframe without a user activation would throw a SecurityError instead of a NotAllowedError, which is what is thrown for non-payment credentials. This is a breaking change, a

concepts

  1. Error Rename

    The raw rename: NotAllowedError is now thrown for cross-origin / no-activation payment credential creation, replacing the historical SecurityError.

  2. Cross-origin iframe envelope

    A sandboxed iframe harness shows the bug envelope: payment credential creation without transient user activation should align with WebAuthn and report NotAllowedError, not the legacy SecurityError.

  3. Migration checklist for catch blocks

    Side-by-side before/after with a live linter — paste your try/catch code, get flagged for any payment create branch that still keys off only the old SecurityError.

  4. Error name probe

    Trigger credentials.create({ payment }) with three failure shapes (cross-origin SPC, user cancel, abort) and watch each error.name appear in a matrix with pre-135 vs 135+ vs this-browser columns.

  5. Credential Creation Tester

    Four scenarios: payment vs non-payment credential, with vs without user activation. Run each and see the actual error name thrown, compared to pre-135 vs Chrome 135 expected. Shows the exact scenario where SecurityError → NotAllowedError matters for catch-block code.

why it shipped

As part of Secure Payment Confirmation (SPC), WebAuthn credentials with the 'payment' extension could be created in a cross-origin iframe before this was allowed for other WebAuthn credentials. When the ability to do this for all WebAuthn credentials was added in https://github.com/w3c/webauthn/pull/1801, an accidental spec misalignment was made. In the very specific case of credential creation in a cross-origin iframe without user activation, the SPC spec said to throw a SecurityError, whilst the WebAuthn spec said to throw a NotAllowedError.

references