Re: [webauthn] Credential ID uniqueness expectations are inconsistent/vague

Actually... apparently someone already thought of this. The last paragraph of [6.1. Registering a new credential][make-cred] reads:

>To avoid ambiguity during authentication, the Relying Party SHOULD check that each credential is registered to no more than one user. If registration is requested for a redential that is already registered to a different user, the Relying Party SHOULD fail this ceremony, or it MAY decide to accept the registration, e.g. while deleting the older registration.

How embarassing to have missed that... It might however be worthwile to make this one of the formal algorithm steps.

[make-cred]: https://w3c.github.io/webauthn/#registering-a-new-credential

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/579#issuecomment-334752813 using your GitHub account

Received on Friday, 6 October 2017 13:21:57 UTC