Prescriptive behaviours for Autofill UI

[sbweeden]

Proposed Change

Following on from the discussion held at the TPAC face-to-face in Vancouver...

In order to ensure consistent capability from the autofill UI, there is a desire for the specification to describe more formally certain capabilities that should be exposed. For example, when navigator.credentials.get is invoked with mediation: "conditional" :

• the autofill UI should display "Passkey from a nearby device", regardless of whether or not there are existing platform credentials registered
• After selecting "Passkey from a nearby device", the use of authenticators via other transports (e.g. a hardware security key connected via USB) should be permitted
• There is a desire to be able to filter discoverable credentials (by use of the allowCredentials list) - see #1793

The ask here is that the spec mandate that implementations of the autofill UI offer these capabilities.

[nsatragno]

From TPAC: we agreed to have some language specifying that discoverable credentials should be accessible through conditional ui regardless of what hardware shape their authenticator takes -- even roaming authenticators. This is equivalent to saying that "passkey from a nearby device" should show an option for security keys & hybrid even if there are no credentials available on the device -- but without specifying actual UI (which is out of scope for the spec).

[codylerum]

I assume that this would allow for the "Passkey from a nearby device" prompt to be shown even if the browser does not support isUserVerifyingPlatformAuthenticatorAvailable?

This would allow for devices which do not have a platform authenticator to still use the "Passkey from a nearby device" feature (maybe as long as they have bluetooth enabled)