excludeCredentials should return InvalidStateError

[jumde]

Brave Version:
1.11.1 (19.08.13.17)

Device details:
iPhone Xr (12.3.1)

I noticed that if I set excludeCredentials and list a credentialId that is already created while creating another credential that a NotAllowedError is returned now.

In this same scenario, Chrome, Edge and FF all return an InvalidStateError. I didn't confirm with the spec which is the correct behavior.

Steps to reproduce:

Go to below site to submit webauthn request:
https://eparkko-lab.github.io/webauthn-playground/?requestType=create&webauthnRequest=eyJjaGFsbGVuZ2UiOiJhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhIiwicnAiOnsiaWQiOiJlcGFya2tvLWxhYi5naXRodWIuaW8iLCJuYW1lIjoiZXBhcmtrby1sYWIuZ2l0aHViLmlvIn0sImF1dGhlbnRpY2F0b3JTZWxlY3Rpb24iOnsidXNlclZlcmlmaWNhdGlvbiI6InByZWZlcnJlZCIsImF1dGhlbnRpY2F0b3JBdHRhY2htZW50IjoiY3Jvc3MtcGxhdGZvcm0ifSwidGltZW91dCI6MTUwMDAsImF0dGVzdGF0aW9uIjoiZGlyZWN0IiwicHViS2V5Q3JlZFBhcmFtcyI6W3sidHlwZSI6InB1YmxpYy1rZXkiLCJhbGciOi03fV0sInVzZXIiOnsiaWQiOiJiYmJiYmJiIiwibmFtZSI6IkJvYmJ5QGxvY2FsaG9zdCIsImRpc3BsYXlOYW1lIjoiYmJiYmJiYiJ9fQ%3D%3D&submitRequest=true

In same browser then submit another request which uses excludeCredentials:
https://eparkko-lab.github.io/webauthn-playground/?requestType=create&webauthnRequest=eyJjaGFsbGVuZ2UiOiJhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhIiwicnAiOnsiaWQiOiJlcGFya2tvLWxhYi5naXRodWIuaW8iLCJuYW1lIjoiZXBhcmtrby1sYWIuZ2l0aHViLmlvIn0sImF1dGhlbnRpY2F0b3JTZWxlY3Rpb24iOnsidXNlclZlcmlmaWNhdGlvbiI6InByZWZlcnJlZCIsImF1dGhlbnRpY2F0b3JBdHRhY2htZW50IjoiY3Jvc3MtcGxhdGZvcm0ifSwidGltZW91dCI6MTUwMDAsImF0dGVzdGF0aW9uIjoiZGlyZWN0IiwicHViS2V5Q3JlZFBhcmFtcyI6W3sidHlwZSI6InB1YmxpYy1rZXkiLCJhbGciOi03fV0sInVzZXIiOnsiaWQiOiJiYmJiYmJiIiwibmFtZSI6IkJvYmJ5QGxvY2FsaG9zdCIsImRpc3BsYXlOYW1lIjoiYmJiYmJiYiJ9LCJleGNsdWRlQ3JlZGVudGlhbHMiOlt7InR5cGUiOiJwdWJsaWMta2V5IiwiaWQiOiIke2xhc3RHZW5lcmF0ZWRJZH0ifV19&submitRequest=true

Notice the NotAllowedError returned by Brave vs InvalidStateError that is returned by other browsers. This could potentially have an impact on RPs.

[srirambv]

Verification passed on iPhone XR with iOS 12.1 running 1.12(19.09.07.08)
Webauthn_1413.zip

Verification PASSED on iPad Air 3rd Generation with iOS 13.1 running 1.12 (19.09.10.13):

Verification passed on iPhone 7+ with iOS 12.4.1 running 1.12(19.09.13.06)