#Module credentials

Web Authentication Level 3 (passkeys, security keys) and the Credential Management container it hangs off (navigator.credentials). The options are passed in their standard JSON form (PublicKeyCredentialCreationOptionsJSON / PublicKeyCredentialRequestOptionsJSON: binary members in base64url), which is what a server sends: a module can hand it over as is. The browser checks them, decides the RP ID (a registrable domain suffix of the document's domain), builds clientDataJSON, and asks the operating system's authenticators (Windows: Windows Hello, security keys, a phone), whose dialog the user answers. Only a secure context may call these (SecurityError otherwise); a ceremony needs a recent key press or click in the page (security.webauthn.require_user_activation) and the page's tab shown in the focused window (security.webauthn.require_focus), else NotAllowedError; one ceremony at a time per document. Rejections use the Error codes: Not_Allowed (cancelled, timed out, no credential, refused), Invalid_State (an excluded credential exists), Not_Supported, Security (RP ID), Type (malformed options), Abort (the signal's reason), Encoding (invalid base64url).

Exposed to: Window. Source: api/credentials.widl.

Odin: import "wren:credentials".

#Types

#handle PublicKeyCredential : Object

A PublicKeyCredential: the authenticator's answer, with its response (attestation or assertion).

Checked by the browser on every call (lookup_PublicKeyCredential).

#enum CredentialMediation : i32

CredentialMediationRequirement.

#enum CredentialBytes : i32

The binary members of a credential and its response.

#Functions

#CredentialsContainer_create

Promise<PublicKeyCredential> CredentialsContainer_create(string options, CredentialMediation mediation = Optional, optional AbortSignal signal)

navigator.credentials.create({publicKey}): settles with a PublicKeyCredential, or 0 (null) for silent mediation. Conditional mediation is not supported (Not_Allowed).

Host: CredentialsContainer_create :: proc(c: ^Call, options: string, mediation: Api_CredentialMediation, signal: Api_AbortSignal) -> u64

#CredentialsContainer_get

Promise<PublicKeyCredential> CredentialsContainer_get(string options, CredentialMediation mediation = Optional, optional AbortSignal signal)

navigator.credentials.get({publicKey}): settles with a PublicKeyCredential, or 0 (null) for silent mediation. Conditional mediation is not supported (Type, as Credential Management says).

Host: CredentialsContainer_get :: proc(c: ^Call, options: string, mediation: Api_CredentialMediation, signal: Api_AbortSignal) -> u64

#CredentialsContainer_preventSilentAccess

Promise CredentialsContainer_preventSilentAccess()

navigator.credentials.preventSilentAccess(): nothing to forget for public key credentials (they always involve the user); settles once the document is checked.

Host: CredentialsContainer_preventSilentAccess :: proc(c: ^Call) -> u64

#PublicKeyCredential_enabled

bool PublicKeyCredential_enabled()

Whether the API is on for this document (security.webauthn.enabled and a secure context).

Host: PublicKeyCredential_enabled :: proc(c: ^Call) -> bool

#PublicKeyCredential_isUserVerifyingPlatformAuthenticatorAvailable

Promise<bool> PublicKeyCredential_isUserVerifyingPlatformAuthenticatorAvailable()

PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() (Windows Hello is set up).

Host: PublicKeyCredential_isUserVerifyingPlatformAuthenticatorAvailable :: proc(c: ^Call) -> u64

#PublicKeyCredential_isConditionalMediationAvailable

Promise<bool> PublicKeyCredential_isConditionalMediationAvailable()

PublicKeyCredential.isConditionalMediationAvailable(): false (no autofill of passkeys yet).

Host: PublicKeyCredential_isConditionalMediationAvailable :: proc(c: ^Call) -> u64

#PublicKeyCredential_getClientCapabilities

Promise<string> PublicKeyCredential_getClientCapabilities()

PublicKeyCredential.getClientCapabilities(): settles with the record as JSON text ({"hybridTransport":true,...}, keys in ascending order, extensions as "extension:<id>").

Host: PublicKeyCredential_getClientCapabilities :: proc(c: ^Call) -> u64

#PublicKeyCredential_checkRpId

void PublicKeyCredential_checkRpId(string rp_id) raises

The RP ID check of the signal methods (signalUnknownCredential...): Security when rp_id is not a registrable domain suffix of, nor equal to, the document's domain. The signals themselves reach no authenticator on this platform: their promises settle with undefined once checked, as for an authenticator that ignores them.

Raises: returns an Error (see web).

Host: PublicKeyCredential_checkRpId :: proc(c: ^Call, rp_id: string) -> Api_Error

#PublicKeyCredential_isAssertion

bool PublicKeyCredential_isAssertion(PublicKeyCredential credential)

true for an assertion (get), false for a new credential (create).

Host: PublicKeyCredential_isAssertion :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> bool

#PublicKeyCredential_id

string PublicKeyCredential_id(PublicKeyCredential credential)

id: rawId in base64url.

Host: PublicKeyCredential_id :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> string

#PublicKeyCredential_bytes

Buffer PublicKeyCredential_bytes(PublicKeyCredential credential, CredentialBytes which) raises

A binary member as a new buffer. Not_Found when the credential has none (userHandle absent, getPublicKey() null, a member of the other kind of response).

Raises: returns an Error (see web).

Host: PublicKeyCredential_bytes :: proc(c: ^Call, credential: Api_PublicKeyCredential, which: Api_CredentialBytes) -> (u64, Api_Error)

#PublicKeyCredential_authenticatorAttachment

string PublicKeyCredential_authenticatorAttachment(PublicKeyCredential credential) raises

authenticatorAttachment ("platform", "cross-platform"); Not_Found for null.

Raises: returns an Error (see web).

Host: PublicKeyCredential_authenticatorAttachment :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> (string, Api_Error)

#PublicKeyCredential_transports

string PublicKeyCredential_transports(PublicKeyCredential credential)

response.getTransports(), comma separated, in lexicographical order.

Host: PublicKeyCredential_transports :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> string

#PublicKeyCredential_publicKeyAlgorithm

i32 PublicKeyCredential_publicKeyAlgorithm(PublicKeyCredential credential)

response.getPublicKeyAlgorithm() (a COSE algorithm identifier); 0 for an assertion.

Host: PublicKeyCredential_publicKeyAlgorithm :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> i32

#PublicKeyCredential_clientExtensionResults

string PublicKeyCredential_clientExtensionResults(PublicKeyCredential credential)

getClientExtensionResults() in its JSON form (AuthenticationExtensionsClientOutputsJSON).

Host: PublicKeyCredential_clientExtensionResults :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> string

#PublicKeyCredential_toJSON

string PublicKeyCredential_toJSON(PublicKeyCredential credential)

toJSON(): RegistrationResponseJSON or AuthenticationResponseJSON, as text.

Host: PublicKeyCredential_toJSON :: proc(c: ^Call, credential: Api_PublicKeyCredential) -> string

Edit this page on GitHub