WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard

--- description: WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard - Enforces atomic cancellation cascades and dedicated AbortController state machines for WebAuthn conditional mediation (passkey autofill) requests. Prevents InvalidStateError browser locks, credential prompt hijacking, and token desynchronization during active UI re-renders or transitions to modal authentication ceremonies. globs: src/**/*.{ts,tsx}, app/**/*.{ts,tsx}, lib/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/webauthn-conditional-mediation-abortsignal-chaining-standard" --- # WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unmanaged Conditional WebAuthn Ceremonies Causing Credential Manager Deadlocks and Prompt Hijacking ## System Constraints You are a Principal Security and Frontend Systems Architect enforcing the WebAuthn Conditional Mediation AbortSignal Chaining Standard. You must ensure that every navigator.credentials.get() and navigator.credentials.create() call is strictly bound to an isolated or cascaded AbortController. Unhandled background conditional ceremonies that conflict with user-initiated modal ceremonies or survive component unmounts must be eliminated. ## Strict Guidelines - Engineers MUST ALWAYS bind any `navigator.credentials.get({ mediation: 'conditional', ... })` call to an explicit `AbortController.signal`. - Engineers MUST ALWAYS abort active conditional mediation controllers before dispatching an explicit user-initiated (modal) WebAuthn ceremony. - Engineers MUST explicitly handle DOMException `AbortError` and suppress it from propagating as a runtime failure or user-facing alert. - Components NEVER execute raw, untracked `navigator.credentials.get()` within uncontained `useEffect` or lifecycle hooks without returning an atomic abort cleanup function. - Services MUST serialize authentication calls using a mutex or state machine to guarantee only one WebAuthn ceremony occupies the browser agent at any instant. - Code SHOULD leverage `AbortSignal.any()` when combining component lifecycle cancellation with user cancellation triggers. ## Bad vs Good Implementations ### WebAuthn Autofill Hook with Atomic Abort Cleanup and Modal Preemption #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Failing to attach an AbortSignal to a conditional mediation request locks the browser's credential manager. If the component re-renders or the user clicks an explicit 'Sign in with Passkey' button, the second ceremony fails immediately with an InvalidStateError. Furthermore, unmount without aborting creates a race condition where stale credential assertions resolve against dismantled component state. ```typescript import { useEffect } from 'react'; export function usePasskeyAutofill(options: CredentialRequestOptions) { useEffect(() => { // ANTI-PATTERN: No AbortController passed; unmount leaves WebAuthn lock active. // Subsequent modal sign-in or re-render throws InvalidStateError. navigator.credentials.get({ ...options, mediation: 'conditional', }).then((assertion) => { if (assertion) { window.location.href = '/dashboard'; } }).catch((err) => { console.error('Passkey failed', err); // Pollutes logs on benign unmount }); }, [options]); } ``` #### Production Standard (Correct) > **Standard**: Instantiates an AbortController bound to component lifecycle, cancels pending WebAuthn conditional requests on teardown, and specifically catches and swallows DOMException 'AbortError'. Exposes an explicit cancelAutofill method to atomically yield credential control prior to launching user-driven modal authentication. ```typescript import { useEffect, useRef } from 'react'; export function usePasskeyAutofill( getOptions: () => Promise<CredentialRequestOptions>, onSuccess: (cred: Credential) => Promise<void> ) { const abortControllerRef = useRef<AbortController | null>(null); useEffect(() => { const controller = new AbortController(); abortControllerRef.current = controller; async function startAutofill() { if (!window.PublicKeyCredential || !PublicKeyCredential.isConditionalMediationAvailable) { return; } const isAvailable = await PublicKeyCredential.isConditionalMediationAvailable(); if (!isAvailable || controller.signal.aborted) return; try { const options = await getOptions(); if (controller.signal.aborted) return; const credential = await navigator.credentials.get({ ...options, signal: controller.signal, mediation: 'conditional', }); if (credential && !controller.signal.aborted) { await onSuccess(credential); } } catch (err: unknown) { if (err instanceof DOMException && err.name === 'AbortError') { // Normal lifecycle teardown or preemptive modal transition return; } throw err; } } startAutofill(); return () => { controller.abort('Component unmounted or options changed'); abortControllerRef.current = null; }; }, [getOptions, onSuccess]); return { cancelAutofill: () => abortControllerRef.current?.abort('Preempted by user action'), }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard

WebAuthn Conditional Mediation AbortSignal Chaining & Atomic Cancellation Standard defines an industrial-grade behavioral standard for security engineering. Enforces atomic cancellation cascades and dedicated AbortController state machines for WebAuthn conditional mediation (passkey autofill) requests. Prevents InvalidStateError browser locks, credential prompt hijacking, and token desynchronization during active UI re-renders or transitions to modal authentication ceremonies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unmanaged Conditional WebAuthn Ceremonies Causing Credential Manager Deadlocks and Prompt Hijacking Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unmanaged Conditional WebAuthn Ceremonies Causing Credential Manager Deadlocks and Prompt Hijacking	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS bind any `navigator.credentials.get({ mediation

Engineers MUST ALWAYS bind any `navigator.credentials.get({ mediation: 'conditional', ... })` call to an explicit `AbortController.signal`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.