Re: [webauthn] How to know if a user has already registered a device? (#1749)

>  I think only `credentials.exists(rpId)` is all that is needed. Is there any credential stored for the RP? How is that a super-cookie?

Because if you are doing the responsible thing, and *not* forcing discoverable credentials, you need the credentialIds present to pass to devices to check that they match for this rpId or not. 



-- 
GitHub Notification of comment by Firstyear
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1749#issuecomment-1824974329 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 23 November 2023 22:40:42 UTC