Safari webauthn excludeCredentials

Question

ebdev2024 OP

Created Mar ’24

Replies 2

Boosts 1

Participants 3

Safari is allowing users to create multiple passkeys despite setting the excludeCredentials in PublicKeyCredentialCreationOptions (https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/create#excludecredentials). I also included appidExclude(https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#appidexclude) but it was still allowing me to create multiple passkeys on the same iCloud account.

This does not happen in other browsers.

Can anyone point me to any documentation regarding this? Much appreciated

https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#appidexclude

https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/create#excludecredentials

Boost

Answer 1

Systems Engineer OP

Apple

Apr ’24

There's a known issue in Safari 17.4 where excludeCredentials was getting ignored. It should be working again in Safari Technology Preview 191. If you're still having issues, please let us know through Feedback Assistant!

0

Answer 2

Xaber OP

Apr ’24

We use webauthn technology to manage crypto assets and because of this issue our users lost a lot of money, please fix it as soon as possible!!!!

0