search

lbuchs / WebAuthn

A simple PHP WebAuthn (FIDO2/Passkey) server library
https://webauthn.lubu.ch
MIT License
419 stars 75 forks source link

credentialId is always unique #65

Closed tlokot closed 1 year ago

tlokot commented 1 year ago

I'm trying to add the excludeCredentials list to createArgs, but both TouchID and my Yubikey 5C Nano produce a unique credentialId on every registrations.

How do you detect duplicate registrations of the same key/device? I have tried with/without attestation and with/without root certificate checks. Is something else required to make this work?

tlokot commented 1 year ago

Ignore this. The credentialIdId's must not be base64_encoded when passed through the API. The API now detects duplicate registrations as expected