- From: Mitar via GitHub <noreply@w3.org>
- Date: Wed, 09 Jul 2025 20:38:46 +0000
- To: public-webauthn@w3.org
If `excludeCredentials` (or something similar) would accept [user ID](https://www.w3.org/TR/webauthn/#dom-publickeycredentialuserentity-id) as the value, then I could use a constant user ID for all our users and prevent creation of a new key if one exists for that user. Using constant ID is against [the standard though](https://www.w3.org/TR/webauthn/#dom-publickeycredentialuserentity-id): > Note: the [user handle](https://www.w3.org/TR/webauthn/#user-handle) ought not be a constant value across different accounts, even for [non-discoverable credentials](https://www.w3.org/TR/webauthn/#non-discoverable-credential), because some authenticators always create [discoverable credentials](https://www.w3.org/TR/webauthn/#discoverable-credential). Thus a constant [user handle](https://www.w3.org/TR/webauthn/#user-handle) would prevent a user from using such an authenticator with more than one account at the [Relying Party](https://www.w3.org/TR/webauthn/#relying-party). -- GitHub Notification of comment by mitar Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1568#issuecomment-3053938370 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 9 July 2025 20:38:47 UTC