search

w3c / webauthn

Web Authentication: An API for accessing Public Key Credentials
https://w3c.github.io/webauthn/
Other
1.19k stars 172 forks source link

Should steps 28 and 29 occur before Step 27 in the registration ceremony #2204

Open zacknewman opened 1 week ago

zacknewman commented 1 week ago

Currently step 27 occurs before steps 28 and 29; however it seems weird to "create and store a new credential record in the user account" before successfully completing steps 28 and 29, right? This means one could save a credential even though the ceremony fails later.

A similar issue exists for the authentication ceremony where step 23 occurs before steps 24 and 25.

I think moving those steps last makes the most sense since this way any credential creation or update occurs iff the ceremony succeeds.

sbweeden commented 1 day ago

agree this should be switched. @emlun to create PR per WG call on 20 Nov