Re: Upcoming changes to Chrome’s WebAuthn implementation (Chrome 112 / 113)

On Fri, Mar 10, 2023 at 7:02 AM John Bradley <jbradley@yubico.com> wrote:

> I don’t think this really breaks anything in practice.  RP can however
> will need to set uv discouraged on make if they set it on get.
>

I just want to highlight something from the linked documentation: if the RP
sets an explicit credProtect level in the WebAuthn request, that overrides
any of these defaults. The defaults are intended to
prevent unpleasant surprises, but RPs don't have to accept them.


Cheers

AGL