search

jeremyevans / rodauth

Ruby's Most Advanced Authentication Framework
http://rodauth.jeremyevans.net
MIT License
1.65k stars 95 forks source link

Mention that webauthn_autofill allows WebAuthn login without an email #357

Closed janko closed 11 months ago

janko commented 11 months ago

Generating WebAuthn authentication options without the account's credentials whitelisted is a WebAuthn feature that's not tied to the autofill UI, as I recently learned, it just requires discoverable credentials.

This allows the developer to provide a button for logging in via a passkey, which should have wider browser support compared to conditional mediation. I thought it's useful to mention that in the documentation.

jeremyevans commented 11 months ago

Makes sense, thanks for the patch!