webauthnfidopasskey

WebAuthn: Is it possible to filter passkey authenticators?


We use passkey in application and we want to restrict Passkey only by Google, Apple, Microsoft authenticators is it possible to do that? Because for example right now Android show me 1Password like a default authenticator.

Create call looks like this right now:

{
  "challenge": "nhkQXfE59Jb97VyyNJkvDiXucMEvltduvcrDmGrODHY",
  "rp": {
    "name": "CredMan App Test",
    "id": "credential-manager-app-test.glitch.me"
  },
  "user": {
    "id": "2HzoHm_hY0CjuEESY9tY6-3SdjmNHOoNqaPDcZGzsr0",
    "name": "helloandroid@gmail.com",
    "displayName": "helloandroid@gmail.com"
  },
  "pubKeyCredParams": [
    {
      "type": "public-key",
      "alg": -7
    },
    {
      "type": "public-key",
      "alg": -257
    }
  ],
  "timeout": 1800000,
  "attestation": "none",
  "excludeCredentials": [],
  "authenticatorSelection": {
    "authenticatorAttachment": "platform",
    "requireResidentKey": true,
    "residentKey": "required",
    "userVerification": "required"
  }
}

Solution

  • No, this is not possible with creation parameters, by design.

    Why do you want to restrict authenticators? What is a user supposed to do if they don't have access to an authenticator that you allow? Will you keep them on a phishable sign in method?