From 40ac1ba19890f7da7808019bbf2b0694c1a8f7b6 Mon Sep 17 00:00:00 2001 From: Arnaud Brousseau Date: Fri, 22 Sep 2023 17:46:13 -0500 Subject: [PATCH 1/3] Add stronger guidance and links around user.id --- docs/passkeys/options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/passkeys/options.md b/docs/passkeys/options.md index a14ad2e..c95154a 100644 --- a/docs/passkeys/options.md +++ b/docs/passkeys/options.md @@ -51,7 +51,7 @@ Turnkey currently supports P256 only. In the near future Turnkey will support RS ### `user` The `user` field has three sub-fields: -- `id`: we recommend setting this to a random string. It won't be visible to the end user. +- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random string** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id);`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials. - `name`: this will show up in the passkey list modal (see screenshot below). We recommend setting this to something the user will recognize: their email, the name of your app, or potentially leave this up to the user:
RPID in registration prompt - `displayName`: as far as we can tell this doesn't show up in current browser UIs. It might show up in future iterations so it's best to populate this with the same value as `name`. From e7052745a155400856c39ee99e583c1334350e03 Mon Sep 17 00:00:00 2001 From: Arnaud Brousseau Date: Fri, 22 Sep 2023 17:47:52 -0500 Subject: [PATCH 2/3] Minor tweaks --- docs/passkeys/options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/passkeys/options.md b/docs/passkeys/options.md index c95154a..b02e11a 100644 --- a/docs/passkeys/options.md +++ b/docs/passkeys/options.md @@ -51,7 +51,7 @@ Turnkey currently supports P256 only. In the near future Turnkey will support RS ### `user` The `user` field has three sub-fields: -- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random string** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id);`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials. +- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random string** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id)`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials". - `name`: this will show up in the passkey list modal (see screenshot below). We recommend setting this to something the user will recognize: their email, the name of your app, or potentially leave this up to the user:
RPID in registration prompt - `displayName`: as far as we can tell this doesn't show up in current browser UIs. It might show up in future iterations so it's best to populate this with the same value as `name`. From f05b7f6723a2b03b4193e529b0e94445236c670d Mon Sep 17 00:00:00 2001 From: Arnaud Brousseau Date: Fri, 22 Sep 2023 17:50:03 -0500 Subject: [PATCH 3/3] string->value --- docs/passkeys/options.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/passkeys/options.md b/docs/passkeys/options.md index b02e11a..1298254 100644 --- a/docs/passkeys/options.md +++ b/docs/passkeys/options.md @@ -51,7 +51,7 @@ Turnkey currently supports P256 only. In the near future Turnkey will support RS ### `user` The `user` field has three sub-fields: -- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random string** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id)`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials". +- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random value** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id)`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials". - `name`: this will show up in the passkey list modal (see screenshot below). We recommend setting this to something the user will recognize: their email, the name of your app, or potentially leave this up to the user:
RPID in registration prompt - `displayName`: as far as we can tell this doesn't show up in current browser UIs. It might show up in future iterations so it's best to populate this with the same value as `name`.