Can a web extension be used as an authenticator for FIDO?

66 Views Asked by At

When interacting with a web app using FIDO on a desktop browser, the browser allows users to choose which athenticator to use. These typically include built-in hardware devices, usb keys, or mobile phones.

How does the browser determine the list of devices to show to the user, and can a web extension be added to that list?

1

There are 1 best solutions below

0
On

Passkey providers should plug into the operating system (using native code), which allows passkeys to be available across all browsers and apps, instead of siloed to a single browser.

With that being said, there are some platforms who do not yet have native platform APIs, so the only option may be to run as a browser extension. In this model, the browser extension intercepts the request, acting as the WebAuthn client instead of the browser/platform. The browser extension is then in full control of the request, and can either service it, or punt it back down to the original WebAuthn client.