Repository navigation
Conversation
nsatragno
left a comment
nsatragno
left a comment
There was a problem hiding this comment.
(Removing the approval for now until I take a look)
|
|
||
| 1. [=set/Append=] |authenticator| to |issuedRequests|. | ||
|
|
||
| : If <code>|options|.{{CredentialRequestOptions/mediation}}</code> is {{CredentialMediationRequirement/conditional}} and <code>|options|.{{CredentialRequestOptions/uiMode}}</code> |
There was a problem hiding this comment.
This is the wrong place for this. The new text is nested inside an infinite loop. All other blocks inside this loop are run in response to a trigger (e.g. if lifeTimer timer expires, If the user exercises a user agent user-interface option to cancel the process, etc.). The way this text is written, the browser would constantly prompt the user to select a credential and the prompt would be refreshed depending on the value of silentlyDiscoveredCredentials.
I would consider instead moving this block to step 1 of If an authenticator becomes available on this client device. If silentlyDiscoveredCredentials was empty, we just added a credential to that set, prompt the user. This, I believe, more closely aligns with with the Chromium implementation.
Your call what to do about newly attached authenticators.
There was a problem hiding this comment.
I've now integrated it with the autofill Conditional UI. It is still within the loop but a boolean prevents it from being displayed more than once.
nsatragno
left a comment
nsatragno
left a comment
There was a problem hiding this comment.
It seems just commenting again does not remove the approval :S
Provides an option (
CredentialUiMode/passive) for RPs to request an assertion using conditional UI but not depending on a form being present on the page that would link the request to autofill.When used, a form with an appropriately-annotated input field could still trigger the request via autofill upon user interaction.
Explainer: https://github.com/w3c/webauthn/blob/main/explainers/conditional-ui-without-autofill.md
Issue: #2144
This depends on w3c/webappsec-credential-management#307.
Preview | Diff