Matthew Miller

Tokens won't refresh after expiration date despite high refresh expiration delta

41

I've implemented `rest_framework_jwt` and have it working for authentication when accessing my API. However, I'm unable to refresh any tokens if it's after the token's `exp` value despite setting `JWT_REFRESH_EXPIRATION_DELTA`...

Intermittent failures on immediate, subsequent executions of `lerna bootstrap` in Node 18.6.0

2

## Current Behavior [SimpleWebAuthn's](https://github.com/MasterKale/SimpleWebAuthn) Node 18 CI pipeline has been intermittently failing lately when it attempts to bootstrap the project. Sometimes the builds completely successfully, and sometimes they fail; simply...

Expand the example server into a reference passkey implementation?

3

Now that passkeys are on the horizon, I believe the current challenge for WebAuthn adoption is a dearth of decent reference implementations. Based on [posts like this on the FIDO-DEV...

Browser package's `browserSupportsWebauthn()` should capitalize "authn"

1

I noticed the spelling of the `browserSupportsWebauthn()` method in browser. I want to update it to `browserSupportsWebAuthn()` for consistency. I'll include this as a breaking change in the next major...

Idea: Add new helper methods for MFA, PWL, and Usernameless registration and authentication

13

SimpleWebAuthn already makes interacting with the WebAuthn library fairly painless, but can I take things one step further? The thought occurred to me that I might be able to offer...

Add ability to query for feasibility of registering a credential that is backup eligible

4

## Proposed Change I propose adding a new API to `PublicKeyCredential` that would allow RP's to determine the feasibility of generating a backup-eligible platform authenticator credential. The majority of our...

Discussing mechanisms for enterprise RP's to enforce bound properties of credentials

25

This week at WWDC Apple demonstrated the ability of one iCloud user with a registered passkey to share that passkey with another individual on a separate iCloud account. The implications...

Spec abstract is out of date on the eve of multi-device credentials and cross-device auth

1

This sentence in the spec's abstract is now out of date with the upcoming launch of multi-device credentials across all three major platform vendors: > Conceptually, one or more [public...

Questions about user handle when supporting usernameless

2

Can you help me understand the overall usernameless flow across attestation and assertion, especially in the context of maintaining user privacy? The main thing I'm trying to figure out is...

Completely revamp webauthn.io, this time with Python and Duo's [py_webauthn](https://github.com/duo-labs/py_webauthn) repo. ## Features **Streamlined registration and authentication experience**  **Advanced settings with shareable...