demo · v137
Error Decoder: live browser probe
The static error decoder shows what Chrome should throw. This variant adds a live try button per matrix row for the same-origin scenarios — your browser calls the API and reports the actual error name. Same-origin rows are directly testable; cross-origin rows show the expected result with an explanation of why a real iframe is needed to verify them.
probing WebAuthn availability…
Not yet run
NotAllowedError (correct)
SecurityError (pre-v137 bug)
| Extension | Frame | Activation | Expected (v137+) | Live result |
|---|
Cross-origin rows require a real cross-origin iframe to observe the SecurityError → NotAllowedError rename. The same-origin rows always throw
NotAllowedError in all Chrome versions — they confirm the API is reachable and behaves consistently.
// v137 only changed ONE cell in this matrix:
// payment extension + cross-origin iframe + NO activation
// pre-v137: SecurityError → v137+: NotAllowedError
//
// Every other cell was already correct. The live buttons below
// confirm the same-origin cells are stable across Chrome versions.
//
// Safe error handler (works for all rows):
try {
await navigator.credentials.create({ publicKey });
} catch (e) {
if (e.name === 'NotAllowedError') handleDenied(); // covers all cases
else if (e.name === 'InvalidStateError') handleDuplicate();
else throw e;
}