-
Notifications
You must be signed in to change notification settings - Fork 346
fix: Use user_verification=preferred for ReAuth WebAuthn challenge
#1798
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Since ReAuth is a second factor credential, it is not necessary to require UV here. This was discussed with ReAuth folks. Also, in practice, downstream clients disregard this because the U2F protocol doesn't expose UV enforcement.
|
@cpisunyer who added this originally. Apologies if you're the wrong person to tag or if I missed some contributor task. |
Requesting an issue be filed for this.
|
Adding some clarification for future me OR other reviewers: It looks like this applies to security policy for FIDO2/WebAuthn security keys. As I understand it, there are two levels of proof a security key can provide and how they fit into Multi-Factor Authentication (MFA).
In many cases, for certain types of logins (ReAuth), a simple touch (UP) is "good enough," even if the device doesn't check a PIN or fingerprint (UV). The logic follows this breakdown:
|
user_verification=preferred for ReAuth WebAuthn challenge
chalmerlowe
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
chalmerlowe
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Since ReAuth is a second factor credential, it is not necessary to require UV here. This was discussed with ReAuth folks.
Also, in practice, downstream clients disregard this because the U2F protocol doesn't expose UV enforcement.