From: Ardis Lu <ardisglu@gmail.com>
Date: Thu, 18 Jun 2026 06:05:03 +0000 (-0700)
Subject: Move prf zeroing logic inside `finally`
X-Git-Tag: v0.1.3~6
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=e6ff26e06b6685657f1b7fc18177c6e304a1293a;p=envpass

Move prf zeroing logic inside `finally`

This approach is more semantically aligned with what is meant to happen (wipe `prf` after it is broadcast, regardless of success or fail), and potentially better scheduling (previous approach allowed theoretical promises in the microtask queue injected after the `fetch` but before yielding to main thread?).
---

diff --git a/src/getPrf.html b/src/getPrf.html
index 9aac142..2fba2ea 100644
--- a/src/getPrf.html
+++ b/src/getPrf.html
@@ -98,8 +98,9 @@
           'Envpass-Challenge': challenge
         },
         body: prf
+      }).finally(() => {
+        prf.fill(0);
       });
-      prf.fill(0);
       if (response.status === 200) {
         p.textContent = 'Successfully sent passkey. You may close this window now.';
         clearTimeout(timeoutId);