corbado / javascript

MIT License
6 stars 1 forks source link

Add "use other method" button to PasskeyBackground screen. #287

Closed Adam3371 closed 3 weeks ago

Adam3371 commented 1 month ago

See last comment

Why

We need to provide an alternative on the PasskeyBackground in the PasskeyVerify block in case that something goes wrong and the passkey challange cannot be completed. (E.g. Safari is sometimes not making an API call after fingerprint is entered and user is stuck in the passkey background screen)

TODOS

Adam3371 commented 1 month ago

Changed task.

If information available, provide directly the fallback options (Use email verification, use phone verification) instead of "Use other method".

Adam3371 commented 1 month ago

passkey-background escape missing linebreak when having 2 fallback options

Adam3371 commented 4 weeks ago

@incorbador is currently working to stop the passkey ceremony (e.g. windows hello) if a fallback option is selected manually. If the problem can be solved

Adam3371 commented 4 weeks ago

Why (Update)

We currently have to deal with 2 different issues on 2 different browsers:

  1. On Mac the Safari browser can reach a state, where no API call is triggered after the biometrics (fingerprint) are entered. Since the passkey-verify screen have no fallback options, this can lead to a broken state where the user is locked in the passkey-verify, passkey-append or passkey-error screen after entering the biometrics.
  2. On Windows on any browser if a user have stored a lot of passkeys, it can take a long time (up to 10 seconds) until the windows hello authenticatior is opened. Sine we need to provide a fallback option in the passkey-verify screen to avoid issue 1, a user on windows can click on the fallback option during the time that the Windows Hello needs to open. This can lead to a situation where the user is in a fallback option (e.g. email OTP) and Windows Hello is then opend. We need avoid to handle a Windows Hello input if the user is already in a fallback state.

TODO

Currently in the "passkey-verify-background-escape-with-cancel" branch, there is a solution for avoiding to handle further inputs of authenticators (windows hello, macOS authenticator ect.). Continue the implementation on this branch.