Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set userVerification to preferred in registration options #18

Conversation

bradpurchase
Copy link
Contributor

  • In the authentication flow, userVerification is set to "preferred" so that user verification is only attempted when possible (i.e. biometric authentication methods like TouchID are presented when available, but it is not required for successful authentication).
  • However, on the registration flow userVerification is not specified. Because of this, userVerification is required as this is the default in SimpleWebAuthn's verifyRegistrationResponse. This presents an issue during the registration flow when using iCloud Keychain or Chrome's built in passkey manager when no user verification method is available (e.g. when a MacBook is in clamshell mode and therefore TouchID is not present/available). In this case, the follow error is returned from authenticator.authenticate(): User verification required, but user could not be verified.
  • This PR addresses this by specifying userVerification: "preferred" on the registration flow as well so that the user verification behaviour is consistent in both flows. This follows the guidance from web.dev on how to specify the userVerification parameter.

@alexanderson1993 alexanderson1993 merged commit f7125a5 into alexanderson1993:main May 30, 2024
3 checks passed
@bradpurchase bradpurchase deleted the registration-userVerification-preferred branch May 30, 2024 18:02
@alexanderson1993
Copy link
Owner

This is published.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants