Skip to content

feat/support-conditional-create#623

Merged
MasterKale merged 4 commits intomasterfrom
feat/support-conditional-create
Oct 6, 2024
Merged

feat/support-conditional-create#623
MasterKale merged 4 commits intomasterfrom
feat/support-conditional-create

Conversation

@MasterKale
Copy link
Owner

@MasterKale MasterKale commented Oct 6, 2024

This PR adds initial support for WebAuthn L3's new "conditional create" to @simplewebauthn/browser startRegistration() as a new useAutoRegister option.

Automatic registration/conditional creation is intended to streamline passkey adoption by allowing the browser to work with a user's password manager (which must also be a passkey provider) after a successful login to register a passkey for that site. Most of the heavy lifting happens between the browser and the provider; the relying party calls startRegistration({...}) and waits for a response back (very similar to using browser autofill with startAuthentication({...}).) If startRegistration() resolves with a response then the RP can verify it as usual and store a passkey for the user, ostensibly to prompt the user to do passkey auth on next login.

Guidance on the proper use of useAutoRegister will be documented on the SimpleWebAuthn docs site (MasterKale/SimpleWebAuthn-homepage#50)

Speaking of verification, the PR also updates @simplewebauthn/server's verifyRegistrationResponse() with a new requireUserPresence option that can be set to false when verifying automatic registration responses (it defaults to true.) It will often be the case during auto registration that the up (User Presence) flag will be false, a first for WebAuthn. This new option will allow RP's to support conditionally verifying these types of responses.

Fixes #582.

@MasterKale MasterKale added package:browser @simplewebauthn/browser package:server @simplewebauthn/server labels Oct 6, 2024
@MasterKale MasterKale added this to the v11.0.0 milestone Oct 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

package:browser @simplewebauthn/browser package:server @simplewebauthn/server

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add support for WebAuthn's conditional create

1 participant