Safari User Gesture requirement removed

[P4sca1]

The user gesture requirement has been removed from WebKit: https://bugs.webkit.org/show_bug.cgi?id=264444
This change is present in macOS 14.4 and iOS 17.4 already: https://forums.developer.apple.com/forums/thread/747036

Instead of a per-page freebie/keeping track of user gestures and cancel events/etc., there's a new rate limiting mechanism with a progressive backoff if too many requests come in close together. If you hit issues with this new rate limiter, please let us know!

We might want to update the Safari Browser Quirks documentation.

[wparad]

@P4sca1 Why is this a discussion, can I ask how this is relevant to this project? I'm genuinely curious.

[P4sca1]

I decided to create a discussion instead of an issue, because this only affects documentation and not the library itself.

It was previously challenging (especially for SPAs) to get WebAuthn working in Safari due to WebKits strict requirements on user gesture. See https://simplewebauthn.dev/docs/advanced/browser-quirks#safari for the current documentation on Safari. You had to use native click handlers and native fetch api (without wrappers such as axios) and the usage of other promises was limited.

Since the user gesture requirement was replaced with a more simple rate limiting strategy, implementing WebAuthn on Safari is now more straightforward and the browser quirks no longer apply for recent versions of Safari.

[wparad]

The question wasn't about whether it was a discussion, it's about the context. You missed including the relevancy in the original post, which is what created confusion. It looks like you are suggesting that the documentation for safari should be changed.

If I understand correctly, on later iOS devices this advice might not be relevant, but it is still relevant for existing devices, right?

I feel like that might add confusion. Perhaps the recommendation is:

In ~N years when everyone is on versions of Safari that use the new strategy, the documentation for SimpleWebAuthn won't need this section anymore.

Is that accurate?

[P4sca1]

The current docs are still relevant for all versions prior to iOS 17.4 and macOS 14.4. However considering the following, I will personally ignore the devices using an older version in favor of a more streamlined implementation:

• Market share for iOS 17.4 and macOS 14.4 or newer is already quite good.
• People who are not using the latest version are likely to use a version that doesn't support WebAuthn at all
• The WebAuthn implementation in some previous versions was buggy, especially when it comes to user gesture detection.

[MasterKale]

@P4sca1 Thank you! It's great to hear that this has already shipped, I'll get the docs updated with a note that the Safari quirks will get better with macOS 14.4 and iOS 17.4 🥳

[MasterKale]

I've updated the docs to reflect this improvement in Safari behavior:

https://simplewebauthn.dev/docs/advanced/browser-quirks#safari