Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add stronger guidance and links around user.id #38

Merged
merged 3 commits into from
Sep 22, 2023
Merged

Add stronger guidance and links around user.id #38

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
40ac1ba
Add stronger guidance and links around user.id
r-n-o Sep 22, 2023
e705274
Minor tweaks
r-n-o Sep 22, 2023
f05b7f6
string->value
r-n-o Sep 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/passkeys/options.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ Turnkey currently supports P256 only. In the near future Turnkey will support RS
### `user`

The `user` field has three sub-fields:
- `id`: we recommend setting this to a random string. It won't be visible to the end user.
- `id`: also known as "user handle", isn't visible to the end-user. We **strongly recommend setting this to a random value** (e.g. `const id = new Uint8Array(32); crypto.getRandomValues(id)`) to make sure a new passkey is created. Be aware: **if you accidentally set this value to an existing user handle, the corresponding passkey will be overridden!**. [This section of spec](https://www.w3.org/TR/webauthn-2/#dictionary-user-credential-params) is clear on the matter: "the user handle ought not be a constant value across different accounts, even for non-discoverable credentials".
- `name`: this will show up in the passkey list modal (see screenshot below). We recommend setting this to something the user will recognize: their email, the name of your app, or potentially leave this up to the user:<br/>
<img src="/img/passkeys/user_name_and_display.png" alt="RPID in registration prompt" width="360px"/>
- `displayName`: as far as we can tell this doesn't show up in current browser UIs. It might show up in future iterations so it's best to populate this with the same value as `name`.
Expand Down