WebAuthn: no prompt during assertion when userPresence is explicitly to required or preferred

[MaximeNdutiye]

Description:

Whenever PublicKeyCredentialRequestOptions.userVerification is explicitly set to "preferred" or "required" Brave behaves as though userVerification="discouraged".

The behaviour is out of spec and always results in the browser not prompting the user to touch their authenticator.

Steps to Reproduce

1. perform a create request

2. perform a get request with userVerification="preferred" or userVerification="required"

Actual result:

There is no prompt for the user to interact with their authenticator.
The returned authenticatorData doesn't have the user presence (UP) flag set.

Expected result:

The user should be prompted to touch their authenticator when userPresence=true and the user presence flag in authenticatorData should be set.

Reproduces how often:

Consistently reproducible.

Brave Version:

Version 1.12 (19.09.13.06)
Device iPhone11,2 (iOS 13.1)

[MaximeNdutiye]

Thanks to @eparkko-lab for the debugger 😄