Re: [webauthn] Requiring user activation to call WebAuthn API (#1293)

The authentication ceremony is defined as having a test of user presence (Section 4, Terminology). 

In addition, 5.1.0 contains:

> Calling [CredentialsContainer](https://w3c.github.io/webappsec-credential-management/#credentialscontainer)'s [preventSilentAccess()](https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-preventsilentaccess) method will have no effect on [PublicKeyCredential](https://w3c.github.io/webauthn/#publickeycredential) credentials, since they always require user interaction.

and the `authenticatorGetAssertion` method described in Section 6.3.3 says

> requireUserPresence
>
> The constant Boolean value true. It is included here as a pseudo-parameter to simplify applying this abstract authenticator  model to implementations that may wish to make a [test of user presence](https://w3c.github.io/webauthn/#test-of-user--presence) optional although WebAuthn does not.

There is additional discussion in prior issues, such as #1785 and #199 .

-- 
GitHub Notification of comment by dwaite
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1293#issuecomment-2353638202 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 16 September 2024 18:35:05 UTC