47c6f243081f
M9/COR-010: fix Firefox passkey requestId millisecond collision
- time
- 2026-05-16 03:02 UTC · 5 months ago
- machine
- koh2
- parent
- e1c408181343
↓ peach-browser-47c6f243.tar.gzatlas at this save
files changed1 file
src/background/passkey.ts+4 −1src/background/passkey.ts+4 −1
@@ -638,7 +638,10 @@638638 return { ok: false, error: "session storage unavailable" };639639 }640640 641- const requestId = Date.now();641+ // Date.now() alone collides if two Firefox passkey requests land in the642+ // same millisecond. Mix in 20 random bits to match the synthetic-id pattern643+ // at requestFirefoxApproval (M9/COR-010).644+ const requestId = Date.now() + Math.floor(Math.random() * 1_000_000);642645 const challenge = base64urlEncode(crypto.getRandomValues(new Uint8Array(32)));643646 const userHandle = base64urlEncode(crypto.getRandomValues(new Uint8Array(32)));644647