Forum Discussion

drossner's avatar
drossner
New Contributor
2 years ago

Webauthn: Support of Related Origin Requests?

I am currently working on implementing Passkey authentication based on https://github.com/w3c/webauthn/wiki/Explainer:-Related-origin-requests. Chromium and Safari seem to support this feature. With ...
browser extension
1P_Dave's avatar
1P_Dave
Icon for Moderator rankModerator
6 months ago

llorenc​ 

Thank you for detailing your use case! While I can't share any dates on when support for Related Origin Requests may be added, I've filed a feature request on your behalf so that our product team knows that this is something that your users need. 

-Dave

PB-49566284

drossner's avatar
drossner
New Contributor
6 months ago

I may add some details as well and hope this adds some velocity :)

As llorenc , we chose to create our passkeys under a single central domain for all our brands, which collectively have seven to eight figures of active accounts. The solution is already live, and so far we are very satisfied with it, especially since the majority of our users access our services via Chromium-based browsers or Safari anyway.

Webauthn Level 3 is currently close to be an official CR (https://github.com/w3c/webauthn/milestone/32).

-D

  • llorenc's avatar
    llorenc
    New Contributor
    6 months ago

    What do you create passkeys for 1Password users? We are planning on opening a new tab.

    And how do you identify 1Password users? We check whether the `navigator.credentials.get` is native code or not. What do you do?

    Thanks!

    • drossner's avatar
      drossner
      New Contributor
      6 months ago

      Well, as our users are mostly "non-techies", the (third party) password manager usage is low. As Firefox users they are defaulted and effectively restricted to a password flow.

      We decide on the getClientCapabilities report for ROR (which is not monkey-patched by 1Password), thus e.g. 1Password users receive an error and the native implementation is triggered.