Accurately detecting when passkeys are unsupported

[arjun-dureja]

I've been using browserSupportsWebAuthn() to check if passkeys are supported, but it doesn't seem to work for all browsers. For example, the Google Search app on iOS will return true for browserSupportsWebAuthn but doesn't actually support passkeys.

Is there another way to accurately detect if passkeys are not supported?

[MasterKale]

Unfortunately this is a reality of passkeys in July 2024. browserSupportsWebAuthn() performs the most fundamental check that can be done to determine if WebAuthn is present. There's not much else an RP can do for feature detection; in many cases all an RP can do is try to make the API call and be prepared to handle instantaneous rejection.

Case in point, some browser runtimes will "lie" about their support if, for example, PublicKeyCredential is present but the application lacks permissions at the OS level to leverage OS-level passkey APIs. A website, which properly attempts to detect WebAuthn and sees that PublicKeyCredential is present, might see the WebAuthn API call reject immediately because the application the web view displaying the website in is not configured properly. There's nothing an RP can do about this as it's a misconfiguration at a native app level.

[arjun-dureja]

Thanks for the response. That's unfortunate. Is there a specific error the WebAuthn API will throw if browser is not configured properly for passkeys? I've seen No available authenticator supported any of the specified pubKeyCredParams algorithms / NotSupportedError. Not sure if this means the browser can't support passkeys at all or if it needs the user to configure something on the OS level.