feat/support-conditional-create #623
Merged
+104
−5
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds initial support for WebAuthn L3's new "conditional create" to @simplewebauthn/browser
startRegistration()
as a newuseAutoRegister
option.Automatic registration/conditional creation is intended to streamline passkey adoption by allowing the browser to work with a user's password manager (which must also be a passkey provider) after a successful login to register a passkey for that site. Most of the heavy lifting happens between the browser and the provider; the relying party calls
startRegistration({...})
and waits for a response back (very similar to using browser autofill withstartAuthentication({...})
.) IfstartRegistration()
resolves with a response then the RP can verify it as usual and store a passkey for the user, ostensibly to prompt the user to do passkey auth on next login.Guidance on the proper use of
useAutoRegister
will be documented on the SimpleWebAuthn docs site (MasterKale/SimpleWebAuthn-homepage#50)Speaking of verification, the PR also updates @simplewebauthn/server's
verifyRegistrationResponse()
with a newrequireUserPresence
option that can be set tofalse
when verifying automatic registration responses (it defaults totrue
.) It will often be the case during auto registration that theup
(User Presence) flag will befalse
, a first for WebAuthn. This new option will allow RP's to support conditionally verifying these types of responses.Fixes #582.