search

cedarcode / webauthn-rails-demo-app

Rails app demonstrating a WebAuthn password-less login
https://webauthn.cedarcode.com
Apache License 2.0
101 stars 41 forks source link

Explicitly set UserVerificationRequirement to 'preferred'… #33

Closed bdewater closed 6 years ago

bdewater commented 6 years ago

…to trigger fingerprint option on Android Chrome 71. It would not show for me at all running the app locally without this.

Related to https://github.com/cedarcode/webauthn-rails-demo-app/issues/31

grzuy commented 6 years ago

Per the spec the user agent should assume the default is "preferred" if not specified: https://www.w3.org/TR/webauthn/#authenticatorSelection.

Bummer that Chrome not doing that from what you're experiencing.

bdewater commented 6 years ago

I've figured out the problem after systematically trying a few things. Already having Yubikey credentials stored on an account disables the fingerprint on Android. If the account has both a Yubikey and an Android credentials stored, all works as expected.

In hindsight it's quite logical 🤦‍♂️ SessionController does dual duty as both registration and authentication controller, depending on the availability of credentials. I'll open a PR to refactor this a bit since I find it not very intuitive or a good example for somebody's production app.

grzuy commented 6 years ago

In hindsight it's quite logical man_facepalming SessionController does dual duty as both registration and authentication controller, depending on the availability of credentials. I'll open a PR to refactor this a bit since I find it not very intuitive or a good example for somebody's production app.

Yes, agree there's room for improvement for Login UX. Good call.