webauthn.io icon indicating copy to clipboard operation
webauthn.io copied to clipboard

Can't create discoverable credentials with security keys

Open serianox opened this issue 2 years ago • 0 comments

When creating a credential on https://webauthn.io/, the RP sets requireResidentKey: false, residentKey: "preferred" in the WebAuthn parameters for the credential creation.

As a result, the client platform (e.g. Windows) do the following:

if the authenticator is a platform,
    let rk=true,
    else let rk=undefined (default false).

Which is good, because we don't want to exhaust security keys. Then credProp returns rk=true for platforms.

The previous UI in the advanced options allowed to set requireResidentKey=true and residentKey="required", which would enable selection of a security key with rk=true in its info, and the creation of a discoverable credential.

But the option has disappeared in the new UI. So we can do a usernameless demo with passkeys, but not with a security key anymore. 😭

serianox avatar Oct 12 '22 21:10 serianox