Letting the user choose where to store the credential

[swagliquido]

Hello and thanks a lot for simplewebauthn, i have a simpledoubt! When registering a new credential, is it possible for the browser to show a UI that allows the user to choose wether to store the credential as a passkey ( and sync it using a service such as google password manager), or internal (such as windows hello), or security key at the same time? I'm asking that because I've been playing with the authenticatorSelection and new preferredAuthenticatorType values, but on both chrome on windows 11 and chrome on android I can just go as far as allowing the user to store the credential in the google password manager or in windows hello, is there a generateRegistrationOptions parameter configuration that would allow to give the user the option to store it in a security key aswell? Because as of simplewebauthn 13 I was only able to let the user either register security keys, or use passkeys that are stored on windows hello or google password manager, but not all the options together, as I've seen on some passkey demo websites, for example on www.passkeys.io i get the options to store the credential wherever I want, in google password manager, windows hello or a security key.

[swagliquido]

As a visual example, here is the UI i get on passkey.io, there is an option to store on windows hello or on external security keys

While this is what i get on simplewebauthn 13, no option for external security keys

this is my current configuration:

await generateRegistrationOptions({
            rpName: 'xxxx',
            rpID: 'xxxx.com',
            timeout: 60000,
            userName: username,
            attestationType: 'none',
            authenticatorSelection: {
                residentKey: 'preferred',
                userVerification: 'required',
                authenticatorAttachment: 'platform',
            },
            excludeCredentials: credentials.map(cred => ({
                id: ,
                transports: ,
            })),
            supportedAlgorithmIDs: [-7, -257, -35, -36, -258, -259, -37,-38, -39],
            preferredAuthenticatorType: 'localDevice', 
        });

I don't know if i'm doing something wrong or the option just isn't available on simplewebauthn

[swagliquido]

I played more with the parameters and finally got it working by removing entirely both the authenticatorAttachment and preferredAuthenticatorType parameters

[swagliquido]

@MasterKale Hi, I hope I don't disturb by tagging, I just thought that you may not have got any notification about the question I posted above a couple of weeks ago. Thanks for v13.1 and the awesome work! I'd definitely donate a pizza if I found an option

[swagliquido]

I actually just sent you a pizza via GitHub sponsor + some extra wireless love for the awesome stuff you make

[MasterKale]

Hey @swagliquido first of all I apologize for leaving you hanging for so long. I'm still ramping up from the holidays slowing things down.

Second, thank you so much for sponsoring me! I appreciate your vote of confidence in me and in SimpleWebAuthn 🙏

To your question about calling WebAuthn in a way that only allows registration of a device-bound passkey: on Android you should still be able to specify authenticatorSelection.residentKey: "discouraged" when calling generateRegistrationOptions() to get an Android emphasizes device-bound registration. However this is a platform-specific trick that can stop working whenever Google changes Android. And the fact that Windows always generates device-bound credentials is a platform-specific behavior that's technically going away soon in Win11 when it finally ships its support for a syncing provider (even if it only syncs between Windows) and for third-party providers.

All this to say, there's no convenient way in WebAuthn to explicitly say "only device-bound passkeys" when you call it. If your requirements are so strict then you can try to use direct attestation. This involves asking for attestation, verifying the statement can be trusted, and then using the authenticator's AAGUID to decide if the authenticator make and model manages passkey lifecycle in a way that is suitable for your use case (e.g. only ever creates device-bound passkeys.) Practically speaking this would limit allowed authenticators to security keys and Windows Hello (for now...)

I'm phone-posting so I may have missed something. Let me know what I can clarify later.

[swagliquido]

@MasterKale thanks a lot for the info! I think you misinterpreted my question as instead of trying to restrict the type of authenticator the user can register, I'm trying to give them as much freedom as possible to register any authenticator they want, but right now on chrome android I can let the user register everything aside a device-bound passkey, I just needed confirmation that i'm not doing anything wrong and that it's expected that I can't show that option on android (if not by restricting to only that option), if you want i can provide screenshots

[MasterKale]

...but right now on chrome android I can let the user register everything aside a device-bound passkey...

Ah then fret not: you're running into Android-specific behavior! Android wants people to create synced passkeys so they're doing what they can to omit the device-bound option unless an RP jumps through some hoops. This isn't anything you're doing wrong when trying to call WebAuthn, it's simply the current reality of "passkeys support on Android."