220559 2021-01-12 13:00:19 -0800 WebAuthn / navigator.credentials.create() does not work in WKWebView-based browsers like Chrome, Firefox 2021-01-14 00:21:38 -0800 1 1 1 Unclassified WebKit WebKit Misc. Safari 14 iPhone / iPad iOS 14 RESOLVED DUPLICATE 219823 P2 Normal --- 1 uwolfer webkit-unassigned ajuma jiewen_tan oldest_to_newest 1719097 0 uwolfer 2021-01-12 13:00:19 -0800 While navigator.credentials.create() works in Safari, it does not work in WKWebView-based apps. Can be reproduced with this demo: https://webauthn.io/ 1719451 1 jiewen_tan 2021-01-13 15:14:50 -0800 *** This bug has been marked as a duplicate of bug 219823 *** 1719536 2 uwolfer 2021-01-13 23:20:27 -0800 (In reply to Jiewen Tan from comment #1) > > *** This bug has been marked as a duplicate of bug 219823 *** @Jiewen: Thank you for triaging this ticket. Are you sure this is a complete duplicate? From reading the patch in bug 219823 it looks to me as the change only affects the *default* browser. My request was to support it in any WKWebView based browsers or apps. 1719547 3 jiewen_tan 2021-01-14 00:05:25 -0800 (In reply to Urs Wolfer from comment #2) > (In reply to Jiewen Tan from comment #1) > > > > *** This bug has been marked as a duplicate of bug 219823 *** > > @Jiewen: Thank you for triaging this ticket. Are you sure this is a complete > duplicate? From reading the patch in bug 219823 it looks to me as the change > only affects the *default* browser. My request was to support it in any > WKWebView based browsers or apps. We currently aren't considering opening this API for all WKWebViews. If you are going to use a web view to do WebAuthn, I would suggest you to use either ASWebAuthenticationSession or SFSafariViewController. 1719552 4 uwolfer 2021-01-14 00:21:38 -0800 (In reply to Jiewen Tan from comment #3) > We currently aren't considering opening this API for all WKWebViews. If you > are going to use a web view to do WebAuthn, I would suggest you to use > either ASWebAuthenticationSession or SFSafariViewController. Are you not considering opening this API because of security concerns? If yes, would it be an idea to only enable the API for "app bound domains" (AFAIK you already enable other security relevant APIs when "app bound domains" is configured). Using either ASWebAuthenticationSession or SFSafariViewController is probably possible, but from a UX point of view not the nicest solution in all cases.