webauthn

webauthn copied to clipboard

## Proposed Change To complement the new [Packed Attestation Statement Certificate Requirements](https://w3c.github.io/webauthn/#sctn-packed-attestation-cert-requirements) section, we should also describe requirements for packed attestations returned from Enterprise Attestation. This should describe the use...

dwaite

Provide a way for Web Extensions to hook into browser's Passkey autofill UI

4

## Description Password Managers are rolling out Passkey support and they're doing this by monkey-patching `navigator.credentials.get` . This is leading to _a lot_ of confusion with users as suddenly native...

arianvp

Ambiguous instructions in the Android Key Attestation Statement Format verification procedure

7

According to: https://w3c.github.io/webauthn/#android-key-attestation * Verify the following using the appropriate authorization list from the attestation certificate [extension data](https://w3c.github.io/webauthn/#android-key-attestation-certificate-extension-data): * The AuthorizationList.allApplications field is not present on either authorization list (softwareEnforced...

vanbukin

rp.name, user.name and user.displayName length limit does not state binary encoding

2

The definitions of [`PublicKeyCredentialEntity.name`](https://w3c.github.io/webauthn/#dom-publickeycredentialentity-name) and [`PublicKeyCredentialUserEntity.displayName`](https://w3c.github.io/webauthn/#dom-publickeycredentialuserentity-displayname) state that >Authenticators MAY truncate a [name](https://w3c.github.io/webauthn/#dom-publickeycredentialentity-name) member’s value so that it fits within 64 bytes [...] and >[Authenticators](https://w3c.github.io/webauthn/#authenticator) MUST accept and store a...

emlun

Clarify how to differentiate between exceptions

9

## Proposed Change As far as I have been able to tell, exceptions from the WebAuthn UI interactions fall into three general categories, that are fairly important to distinguish: 1....

dolda2000

Adding some sentences to describe credential sharing between multiple users

7

## Proposed Change Some of passkey providers have been introduced passkey sharing features across users (family members or co-workers). Current spec does not have any description about the credential sharing...

Kieun

"android-key" and "android-safetynet" are really basic attestation type support?

12

## Proposed Change While I'm integrating FIDO MDS3 with our WebAuthn Server, I figured out that the the [FIDO spec ](https://fidoalliance.org/specs/common-specs/fido-registry-v2.2-ps-20220523.html)and WebAuthn Spec does not align properly regarding attestation types....

Kieun

[Superset] Updating credential metadata and requesting deletion of stale credentials

20

This issue is to consolidate a bunch of issues from over the years around deletion of stale credentials, updating properties of existing credentials, etc and provide a single issue to...

timcappalli

create() and get() return an algorithm, not a credential

1

Both [§5.1.3. Create a New Credential](https://w3c.github.io/webauthn/#sctn-createCredential) and [§5.1.4. Use an Existing Credential to Make an Assertion](https://w3c.github.io/webauthn/#sctn-discover-from-external-source) currently resolve with: > **If any authenticator indicates success,** >[...] >3. Let _constructCredentialAlg_ be...

emlun

Section 5.1.9 on the `parseCreationOptionsFromJSON` method states that > any [DOMString](https://webidl.spec.whatwg.org/#idl-DOMString) attributes in [PublicKeyCredentialCreationOptionsJSON](https://w3c.github.io/webauthn/#dictdef-publickeycredentialcreationoptionsjson) that correspond to [buffer source type](https://webidl.spec.whatwg.org/#dfn-buffer-source-type) attributes in [PublicKeyCredentialCreationOptions](https://w3c.github.io/webauthn/#dictdef-publickeycredentialcreationoptions). This conversion MUST also apply to any...

jschanck