v135 · javascript
Credential Creation Tester
Test what error name navigator.credentials.create() throws in different scenarios — same-origin vs cross-origin iframe, with/without user activation, payment vs non-payment credential. Chrome 135 aligns payment credential errors with non-payment: always NotAllowedError when user activation is missing.
checking WebAuthn…
checking payment extension…
activation: checking…
payment policy: checking…
Before Chrome 135, creating a
payment credential in a cross-origin iframe without user activation threw SecurityError. Non-payment credentials threw NotAllowedError in the same scenario. The inconsistency broke catch-block code that expected the same error name for both. Chrome 135 fixes this: payment credentials now also throw NotAllowedError when activation is missing.
Test scenario
Error name before vs after Chrome 135
Pre-Chrome 135 (broken)
try {
await navigator.credentials.create({
publicKey: {
...opts,
extensions: { payment: { isPayment: true } }
}
});
} catch (e) {
// BUG: payment credential throws 'SecurityError'
// but non-payment throws 'NotAllowedError'
if (e.name === 'NotAllowedError') {
showAuthPrompt(); // ← NEVER reached for payment!
}
if (e.name === 'SecurityError') {
// ← Only reached for payment (wrong!)
handleSecurityError();
}
}
Chrome 135+ (fixed)
try {
await navigator.credentials.create({
publicKey: {
...opts,
extensions: { payment: { isPayment: true } }
}
});
} catch (e) {
// FIXED: payment + non-payment both throw
// 'NotAllowedError' when activation missing
if (e.name === 'NotAllowedError') {
showAuthPrompt(); // ← works for both!
}
// SecurityError still for cross-origin
// permission policy violations (unrelated)
}
Test log
Press a button above to run tests.