search

corbado / flutter-passkeys

Easily provide passkey authentication based on FIDO2 / WebAuthn for Flutter apps (iOS & Android) via a dedicated Flutter package
https://www.corbado.com/passkeys/flutter
BSD 3-Clause "New" or "Revised" License
57 stars 23 forks source link

Support for roaming authenticator/hardware security key #50

Open lauravuo opened 7 months ago

lauravuo commented 7 months ago

Have you considered to add support for roaming authenticators to ios/android?

When using the javascript webauthn APIs (through iOS webview), a following dialog is shown: Screenshot 2024-02-02 at 13 11 12 This provides an easy way to use same client code for both passkeys and security keys. However, when using the flutter library, as shown in your example app, there is only the passkeys option.

Thanks anyway for publishing the library, it has helped me greatly with my experiments on flutter and passkeys 👍

vincentdelitz commented 7 months ago

Hey @lauravuo,

Thanks for raising this issue!

In the current implementation, we intentionally omitted the security key (roaming authenticator) option. This decision was based on our experience, as it often led to confusion among non-technical users. However, we are currently revamping our device and passkeys management in our hosted backend and plan to incorporate a feature toggle that will enable you to provide security keys as an option. This will also necessitate an update to the Flutter package, allowing you to offer security keys as well.

I'll keep you posted / update this GitHub issue as soon as there are any news.

J-tt commented 6 months ago

Hi @vincentdelitz any updates on this?

It's a make or break option for this library for us, even if there's a workaround or patch we can apply that'd be fantastic.

vincentdelitz commented 6 months ago

Hi @vincentdelitz any updates on this?

It's a make or break option for this library for us, even if there's a workaround or patch we can apply that'd be fantastic.

Hey @J-tt, Would you use your own relying party server or a Corbado-hosted one? In general, this feature is still under development, maybe I can provide a workaround though.

J-tt commented 6 months ago

@vincentdelitz were using our own server, it's an internal facing app so there's less concern about user confusion.

J-tt commented 6 months ago

I made a very rough workaround to support just hardware keys (applying this patch will mean you can't use normal passkeys).

You can then override just the passkey_ios dependancy in your flutter pubspec.yaml to a local copy.

0001-Replace-mentions-of-Platform-with-SecurityKey.patch