jeffemmett
/
rspace-online
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(encryptid): allow all authenticator types during passkey registration 

Remove authenticatorAttachment:'platform' constraint so Firefox (and all
browsers) show security keys, phone-as-authenticator, and PIN options
alongside biometrics when registering a new passkey.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeff Emmett 2026-04-15 15:15:56 -04:00
parent deff7369e5
commit 03b1bdf2f1
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/encryptid/webauthn.ts
View File

@ -133,9 +133,6 @@ export async function registerPasskey(
throw new Error('WebAuthn is not supported in this browser'); throw new Error('WebAuthn is not supported in this browser');
} }
// Check platform authenticator availability
const platformAvailable = await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
// Generate user ID (random bytes, not PII) // Generate user ID (random bytes, not PII)
const userId = crypto.getRandomValues(new Uint8Array(32)); const userId = crypto.getRandomValues(new Uint8Array(32));
@ -178,9 +175,10 @@ export async function registerPasskey(
// Require user verification (biometric/PIN) // Require user verification (biometric/PIN)
userVerification: cfg.userVerification, userVerification: cfg.userVerification,
// Prefer platform authenticator, but allow cross-platform (security keys, // No authenticatorAttachment constraint — let the browser offer ALL options:
// phone-as-authenticator) on devices without one (e.g. Linux desktops) // platform (biometrics, PIN, Windows Hello), security keys, phone-as-authenticator.
...(platformAvailable ? { authenticatorAttachment: 'platform' as const } : {}), // Previously forced 'platform' when available, which blocked cross-platform
// authenticators on Firefox and other browsers with limited platform UI.
}, },
// Don't request attestation (privacy) // Don't request attestation (privacy)