tor-browser

commit e06a7c50874f9a0916f8f258d072a40b28150546
parent a02d8e0df2da0e8409b150e68dc402a7037f10f7
Author: Makoto Kato <m_kato@ga2.so-net.ne.jp>
Date:   Fri,  9 Jan 2026 07:09:41 +0000

Bug 2006875 - Set userVerification for Credential Manager. r=jschanck,geckoview-reviewers,ohall

Actually we mistake to pass `requireUserVerification: 1` to Credential Manager,
so we should pass `userVerification` value instead.

Differential Revision: https://phabricator.services.mozilla.com/D277411

Diffstat:
M
dom/webauthn/AndroidWebAuthnService.cpp
 | 
10
+++++++---
M
mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebAuthnTokenManager.java
 | 
2
+-

2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/dom/webauthn/AndroidWebAuthnService.cpp b/dom/webauthn/AndroidWebAuthnService.cpp
@@ -168,9 +168,13 @@ AndroidWebAuthnService::MakeCredential(uint64_t aTransactionId,
         nsString userVerification;
         (void)aArgs->GetUserVerification(userVerification);
         if (userVerification.EqualsLiteral(
-                MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED)) {
-          GECKOBUNDLE_PUT(authSelBundle, "requireUserVerification",
-                          java::sdk::Integer::ValueOf(1));
+                MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED) ||
+            userVerification.EqualsLiteral(
+                MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED) ||
+            userVerification.EqualsLiteral(
+                MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED)) {
+          GECKOBUNDLE_PUT(authSelBundle, "userVerification",
+                          jni::StringParam(userVerification));
         }
 
         nsString authenticatorAttachment;
diff --git a/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebAuthnTokenManager.java b/mobile/android/geckoview/src/main/java/org/mozilla/geckoview/WebAuthnTokenManager.java
@@ -135,7 +135,7 @@ import org.mozilla.gecko.util.WebAuthnUtils;
     }
     final AuthenticationExtensions ext = extBuilder.build();
 
-    // requireUserVerification are not yet consumed by Android's API
+    // userVerification are not yet consumed by Android's FIDO API
 
     final List<PublicKeyCredentialDescriptor> excludedList =
         new ArrayList<PublicKeyCredentialDescriptor>();