Re: [webauthn] attachment is only explicitly used in create()

[ oops, did not mean to hit [Comment] yet, sorry, so continuing with the issue submission here, I've also edited the initial description, so please do not rely on the emailed copy ]

Is the example (above) expected to work (a) due to the RP knowing, from credential creation, that it has a cred for the user backed by a platform-attached authnr and thus is able to place just that one cred  in the `options.allowList` in the call to  `ScopedCredential::[[DiscoverFromExternalSource]](options)` (aka get()) ?

I.e., rather than, (b) being able to state "use any cred registered with this RP that has an attachment of `platform`" ?

I do not think we necessarily need to have (b), but if (a) is the expected way for the use case to work we may want to clarify that in the spec. 




 

-- 
GitHub Notification of comment by equalsJeffH
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/420#issuecomment-296323409 using your GitHub account

Received on Friday, 21 April 2017 22:54:41 UTC