Compatibility with MacOS 12.3

[P4sca1]

After updating to MacOS 12.3, I noticed a new user interface for WebAuthn on Safari:

When using the default option (Apple Keychain), the following error appears in console:

[Error] NotAllowedError: This request has been cancelled by the user.

I don't know if this is an issue with this library, WebAutn on MacOS 12.3 / Safari in general or my implementation.
Would be great if others could share their experience with WebAuthn on MacOS 12.3 / Safari.

I am able to add my iPhone with iOS 15.4 via WebAuthn like before. The change in the UI on MacOS made me think that one WebAuthn authenticator will be shared on all my Apple devices once configured, so that I can login with my Mac after configuring WebAuthn with my iPhone, but this does not seem to be the case.

[P4sca1]

This is what I found in the macOS 12.3 changelog:

A relevant keynote I found: https://developer.apple.com/videos/play/wwdc2021/10106/

I found out that Apple passkeys is an iCloud Keychain backed WebAuthn implementation that syncs across your Apple devices.

[fabian-michael]

This works fine for me.
The only thing is that doesn't work for me is the excludedCredentials option. In Chrome it works as expected.

[P4sca1]

In how far does the excludedCredentials option not work for you? I am using it in my implementation too.

[MasterKale]

@P4sca1 Thanks for alerting me to the changes to Safari's WebAuthn prompt, I hadn't yet updated to macOS 12.3. I'm on it now and can troubleshoot along with you now.

I've known that, for now, passkeys don't seem to work with attestation: 'direct'; you must use attestation: 'none'. Now, If you try to request direct attestation in macOS 12.3's Safari 15.4 then registration will error out and the Safari window will become unresponsive! I've had to force-quit Safari when this happens, so that's fun...

[Error] NotAllowedError: This request has been cancelled by the user.

Do you remember what options you were passing into startRegistration()/startAuthentication()/etc..., however you're calling WebAuthn that threw this error? According to the spec NotAllowedError is either a cancellation/timeout, or no matching authenticator for any entry in allowCredentials. If it's neither of those then it might be a bug in Safari.

The only thing is that doesn't work for me is the excludedCredentials option. In Chrome it works as expected.

It's still the case that all browsers on macOS manage credentials on their own. And based on my testing so far passkeys on macOS will be supported exclusively in Safari. I haven't seen anything indicating that macOS will get an OS-level credential store like iOS has enjoyed for a few releases now :'(

[P4sca1]

The first issue was, that my MacBook was closed (I used it with an external display). Instead of showing that WebAuthn is not available or offering to use the Apple Watch instead of TouchID, it just gives a NotAllowedError.
After I open my MacBook, it shows the TouchID symbol and allows me to try the authentication. That however failed too, with a NotAllowedError. As you mentioned, this is likely because I am using direct attestation. The window does not become unresponsive for me, but the error is thrown.
I can't remember exactly, why I use attestationType: 'direct' for registration. What was the advantage / side-effect of it again? I require the following properties from verifyRegistrationResponse().registrationInfo: fmt, counter, credentialID, credentialPublicKey. Are all of them available with attestationType: 'none'?

[MasterKale]

@P4sca1 I'm going to convert this into a Discussion since it's not necessarily an issue with SimpleWebAuthn.

[MasterKale]

Another fun data point: macOS 12.3.1 and/or Chrome 100 added the ability to use caBLE to register and authenticate:

https://twitter.com/iamkale/status/1510303402412036098

I was able to successfully go through both flows on my iPhone, despite the option only saying "Android phone" 🤯

[MasterKale]

[P4sca1]

iOS and iPadOS 15.5 Release Notes:

Support is added to the passkey technology preview, enabling signing in to passkey-compatible websites and apps on Mac and iPad using an iPhone with a saved passkey. (87998254)

[MasterKale]

I wonder if this is without having to turn on Synced platform credentials in the Developer menu on either Safari or iOS. I'll investigate this week 🤔