Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat/support-conditional-create #623

Merged
merged 4 commits into from
Oct 6, 2024
Merged

Conversation

MasterKale
Copy link
Owner

@MasterKale MasterKale commented Oct 6, 2024

This PR adds initial support for WebAuthn L3's new "conditional create" to @simplewebauthn/browser startRegistration() as a new useAutoRegister option.

Automatic registration/conditional creation is intended to streamline passkey adoption by allowing the browser to work with a user's password manager (which must also be a passkey provider) after a successful login to register a passkey for that site. Most of the heavy lifting happens between the browser and the provider; the relying party calls startRegistration({...}) and waits for a response back (very similar to using browser autofill with startAuthentication({...}).) If startRegistration() resolves with a response then the RP can verify it as usual and store a passkey for the user, ostensibly to prompt the user to do passkey auth on next login.

Guidance on the proper use of useAutoRegister will be documented on the SimpleWebAuthn docs site (MasterKale/SimpleWebAuthn-homepage#50)

Speaking of verification, the PR also updates @simplewebauthn/server's verifyRegistrationResponse() with a new requireUserPresence option that can be set to false when verifying automatic registration responses (it defaults to true.) It will often be the case during auto registration that the up (User Presence) flag will be false, a first for WebAuthn. This new option will allow RP's to support conditionally verifying these types of responses.

Fixes #582.

Verified

This commit was signed with the committer’s verified signature.
MasterKale Matthew Miller

Verified

This commit was signed with the committer’s verified signature.
MasterKale Matthew Miller

Verified

This commit was signed with the committer’s verified signature.
MasterKale Matthew Miller
@MasterKale MasterKale added package:browser @simplewebauthn/browser package:server @simplewebauthn/server labels Oct 6, 2024
@MasterKale MasterKale added this to the v11.0.0 milestone Oct 6, 2024

Verified

This commit was signed with the committer’s verified signature.
MasterKale Matthew Miller
@MasterKale MasterKale merged commit 5e3e571 into master Oct 6, 2024
1 check passed
@MasterKale MasterKale deleted the feat/support-conditional-create branch October 6, 2024 23:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
package:browser @simplewebauthn/browser package:server @simplewebauthn/server
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add support for WebAuthn's conditional create
1 participant