[w3ctag/design-reviews] Other Spec Review: WebAuthn Cross-Device Fallback URL Extension (Issue #1293)

harshlal028 created an issue (w3ctag/design-reviews#1293)

### Specification

https://github.com/w3c/webauthn/pull/2380

### Explainer

https://github.com/w3c/webauthn/blob/main/explainers/cross-device-fallback-url.md

### Links

- Previous early design review, if any: N/A
- An introduction to the feature, aimed at unfamiliar audiences: During cross-device (hybrid transport) WebAuthn authentication—where a user scans a QR code or connects to a mobile device (authenticator) from a desktop client—the mobile device may not have a matching passkey for the Relying Party (RP). Today, this leads to a dead-end experience on the mobile device, forcing the user to abandon the mobile flow and return to the desktop to try another sign-in method. The `crossDeviceFallbackUrl` extension allows the RP to specify a same-site HTTPS fallback URL in `navigator.credentials.get()` options so the remote authenticator device can offer to transition the user directly into an alternative authentication or onboarding flow on that device.
- A description of the problems that end-users were facing before this proposal: Users scanning a hybrid transport QR code with a phone that lacks the expected passkey hit a dead end on their mobile device with no guided way to recover or sign in on that device.
- Alternatives considered: Relying solely on client-side timeout/cancellation on the desktop page; or allowing custom URI schemes vs. restricting to HTTPS URLs that are same-site with the RP ID (restricted to same-site HTTPS URLs and checked against CSP to prevent abuse).
- Examples of how to use the proposal to solve the end-users' problems: Passing `extensions: { crossDeviceFallbackUrl: "..." }` inside `publicKey` options to `navigator.credentials.get()`.
- What do the end-users experience with this proposal: When a user initiates hybrid authentication and their mobile device does not have a matching passkey for the RP, the mobile OS/authenticator UI can offer an option to open the RP-provided fallback URL in the mobile browser (and inform the client that the fallback URL was processed via `WebAuthnOperationException`).
- User research you did to validate the problem and/or design, if any: N/A
- Web Platform Tests: https://github.com/web-platform-tests/wpt/pull/60190

### The specification

- [x] Follows the [Web Platform Design Principles](https://www.w3.org/TR/design-principles/).
- [x] Includes Security and Privacy Considerations sections based on answers to the [Security/Privacy Questionnaire](https://www.w3.org/TR/security-privacy-questionnaire/).

### Where and by whom is the work is being done?

- GitHub repo: https://github.com/w3c/webauthn
- Primary contacts:
  - @harshlal028, Google
  - @kreichgauer, Google
  - @timcappalli, Okta
- Organization/project driving the specification: Google / W3C Web Authentication Working Group
- This work is being funded by: Google
- Primary standards group developing this feature: W3C Web Authentication Working Group (in coordination with FIDO Alliance CTAP / Hybrid Working Group)
- Incubation and standards groups that have discussed the design:
  - W3C Web Authentication WG (w3c/webauthn#2341, w3c/webauthn#2380)
  - FIDO Alliance FIDO2 / CTAP Technical Working Group (fido-alliance/fido-2-specs#1755, fido-alliance/fido-2-specs#1761)

### Feedback so far

- Multi-stakeholder feedback:
  - Chromium comments: Positive; prototyped behind flag (commit 55da8e2).
  - Mozilla comments: Discussed in WebAuthn WG calls and reviewed in PR #2380.
  - WebKit comments: Reviewed in PR #2380 by Apple WebAuthn WG members (@pascoej).
- Major unresolved issues with or opposition to this specification: None blocking this extension. Future enhancements to bind the fallback URL session to the hybrid tunnel are tracked separately in https://github.com/w3c/webauthn/issues/2478.
- Status/issue trackers for implementations:
  - Chromium: https://issues.chromium.org/issues/509934168
  - Gecko: WPT sync bug 2042911
  - WebKit: TBD

### You should also know that...

The wire protocol and remote authenticator behavior for carrying and handling the fallback URL over hybrid transport are specified in the FIDO CTAP specification (`crossDeviceFallbackUrl`), while WebAuthn PR #2380 defines the client/authenticator extension inputs, URL validation (HTTPS, same-site with `rpId`, CSP compliance), and exception handling (`WebAuthnOperationException`).

<!-- Content below this is maintained by @w3c-tag-bot -->
---

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1293


-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1293
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1293@github.com>