v137 · javascript

Align error type thrown for 'payment' WebAuthn credential creation: SecurityError => NotAllowedError

Correct the error type thrown during WebAuthn credential creation for 'payment' credentials. Due to a historic specification mismatch, creating a 'payment' credential in a cross-origin iframe without a user activation would throw a SecurityError instead of a NotAllowedError, which is what is thrown for non-payment credentials. This is a breaking change, a

concepts

  1. Error Rename

    WebAuthn payment credential creation now throws NotAllowedError instead of SecurityError, matching every other user-gated WebAuthn flow.

  2. SPC Error Probe

    Side-by-side same-origin vs sandboxed (cross-origin) call, both without a user activation — pinpoints the exact path the v137 rename targets.

  3. Error Decoder

  4. Credential Flow Simulator

    Step through the affected payment/WebAuthn credential creation path: a cross-origin iframe without transient activation changed from SecurityError to NotAllowedError in Chrome 137. Unaffected same-origin, with-activation, and success paths stay visible for comparison.

  5. SPC Error Probe with Activation

    The third lane from the spec matrix: credentials.create({ payment }) called with a fresh user gesture. Confirms that the v137 rename only fires on the missing-activation path — with activation, both pre-v137 and v137+ always throw NotAllowedError, never SecurityError.

  6. Error Decoder: live probe

    The static error decoder tells you what Chrome should throw. This variant adds live try buttons for same-origin rows — your browser actually calls the API and reports the real error name. Cross-origin rows show expected results with an explanation of why a real iframe is needed to verify them.

why it shipped

As part of Secure Payment Confirmation (SPC), WebAuthn credentials with the 'payment' extension could be created in a cross-origin iframe before this was allowed for other WebAuthn credentials. When the ability to do this for all WebAuthn credentials was added in https://github.com/w3c/webauthn/pull/1801, an accidental spec misalignment was made. In the very specific case of credential creation in a cross-origin iframe without user activation, the SPC spec said to throw a SecurityError, whilst the WebAuthn spec said to throw a NotAllowedError.

references