Using WKWebView and a yubikey?

Question

Created Mar ’23

Replies 5

Boosts 0

Views 1.3k

Participants 2

Coworkers are trying it and it's not working -- the google response says there was a problem with it, and not much else.

I do not have a yubikey (at least not yet 😄), and I'm really not good at the GUI stuff so I don't know as much about it as I probably should. Searching the fora here found a question and comment that didn't make a lot of sense to me, but again I admit to a lot of ignorance here.

So any pointers to where I should be look would be appreciated.

Answered by Systems Engineer in 748996022

Passkeys and security keys are supported in WKWebView, if the RPID is for an Associated Domain using the webcredentials association. In this case that means only Google-owned apps will be able to authenticate to a Google URL. If you need a web view to authenticate to a domain you don't own, you should use ASWebAuthenticationSession.

Boost

Answer 1

Systems Engineer OP

Apple

Mar ’23

I'm not sure what this question is asking, so I don't know how to help. Can you provide more information about specifically what you're trying to do and what specific issue you're seeing?

0

Answer 2

kithrup OP

Mar ’23

Weird, I don't get notifications for comments, only replies.

For various reasons, we have our own WKWebView window for authentication. We'd like to be able to support yubikeys et al. However... it doesn't look like that's actually possible? Because the WebAuthN support is only provided to full web browsers (and, on macOS [which is all I care about for now 😄], only for the user's default web browser)?

As for what we're seeing, when trying to use a Yubikey, our WKWebView window, which is loaded with a google URL, says that it's not supported.

0

Answer 3

kithrup OP

Mar ’23

See below, hopefully it's clearer?

0

Answer 4

Systems Engineer OP

Apple

Mar ’23

Accepted Answer

Passkeys and security keys are supported in WKWebView, if the RPID is for an Associated Domain using the webcredentials association. In this case that means only Google-owned apps will be able to authenticate to a Google URL. If you need a web view to authenticate to a domain you don't own, you should use ASWebAuthenticationSession.

0

Answer 5

kithrup OP

Mar ’23

As I said, for various reasons, we're using our own window for it.

This seems to match my conclusion that we can't do it, yes? Thanks. 😄

0