How to specify "transports" to "usb" when adding a new entry to the list of credentials allowed in assert?

[ohnowade]

Hi,

Windows 11 released a new support for mobile passkeys recently, after which users need to complete an extra step of selecting an authentication choice first (mobile device or security key, as shown below). Since we only support security keys, this is a bad user experience.

In browser, we can avoid this by setting the transports field to usb when we add an allowed credential:

{
  type: 'public-key',
  id: // key handle,
  transports: ['usb']
}

Also, if we interact with webauthn.dll directly, I believe we can make use of this struct to set the transports:

#define WEBAUTHN_CTAP_TRANSPORT_USB 0x00000001
#define WEBAUTHN_CTAP_TRANSPORT_NFC 0x00000002
#define WEBAUTHN_CTAP_TRANSPORT_BLE 0x00000004
#define WEBAUTHN_CTAP_TRANSPORT_TEST 0x00000008
#define WEBAUTHN_CTAP_TRANSPORT_INTERNAL 0x00000010
#define WEBAUTHN_CTAP_TRANSPORT_FLAGS_MASK 0x0000001F

#define WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION 1

typedef struct _WEBAUTHN_CREDENTIAL_EX {
  // Version of this structure, to allow for modifications in the future.
  DWORD dwVersion;

  // Size of pbID.
  DWORD cbId;
  // Unique ID for this particular credential.
  _Field_size_bytes_(cbId) PBYTE pbId;

  // Well-known credential type specifying what this particular credential is.
  LPCWSTR pwszCredentialType;

  // Transports. 0 implies no transport restrictions.
  DWORD dwTransports;
} WEBAUTHN_CREDENTIAL_EX, *PWEBAUTHN_CREDENTIAL_EX;
typedef const WEBAUTHN_CREDENTIAL_EX *PCWEBAUTHN_CREDENTIAL_EX;

However, I am exploring options to do it through libfido2. I know that fido_assert_allow_cred(fido_assert_t *assert, const unsigned char *ptr, size_t len); should be used to add a credential, but it seems that ptr should point to the key handle directly, but not the structure that also contains transports. Therefore, I am wondering if there are anyway for me to specify the transports value or any other method that I should use?

Thank you!

[LDVG]

Hi,

I know that fido_assert_allow_cred(fido_assert_t *assert, const unsigned char *ptr, size_t len); should be used to add a credential, but it seems that ptr should point to the key handle directly, but not the structure that also contains transports. Therefore, I am wondering if there are anyway for me to specify the transports value or any other method that I should use?

Your observation is correct: there is no method in libfido2 for this. The reason being mainly that libfido2 is more closely modeled after the CTAP specification rather than the WebAuthn specification.

[ohnowade]

I see. Thanks for the clarification!

[James-ZHANG]

@ohnowade , can you share which browser you are testing this with? I'm using Chrome and I cannot avoid this additional click even though all my allowedCredentials have ['usb'] as transports.

Would also appreciate it if you can provide browser versions and OS versions.

[ohnowade]

Yep Chrome and Firefox could both have this issue (transports not in effect), but it was fixed in Chrome 122 (still on Beta) and Firefox 120.