Adding Support for transports in generateAuthenticationOptions()

[kareha]

Hello,
I would like to set the transports as an Option in navigator.credentials.get(options) [In startAuthentication()]

So can have something like:

publicKeyOptions.transports = ['usb', 'nfc', 'ble', 'cable'];

to force security keys challenge.

It is supported in publicKey Object:
https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get#publickey_object_structure

An array of strings providing hints as to the methods the client could use to communicate with the relevant authenticator of the public key credential to retrieve.

Thx

[MasterKale]

Hello @kareha, you can already achieve this when constructing the options you pass to generateAuthenticationOptions() by specifying a static array of security-key-like transports for each entry in allowCredentials:

const options = await generateAuthenticationOptions({
  timeout: 60000,
  allowCredentials: user.devices.map((dev) => ({
    id: dev.credentialID,
    type: 'public-key',
    transports: ['usb', 'nfc', 'ble'],
  })),
  rpID,
});

[MasterKale]

That said, if you specifically only want to support security keys then I'd suggest passing attestation: "required" into generateRegistrationOptions() and then use the AAGUID you get back to allow-list only the make-and-models of authenticators that you want to limit your users to.

I'd argue for most RP's this level of authenticator discrimination isn't necessary, but I don't know your exact use case (e.g. you're subject to government regulation, etc...)