Paskeys within embedded browser?

[lonoak]

Hi,

I'd like to ask for the problem I have seen in a couple of desktop applications using embedded windows browsers (in my case it's under macOS). Passkeys are being used as a second factor here (in a SAML identity provider), and fails in apps that support an external authentication service, which sometimes let you use directly (for example in Zoom as an Outlook plugin), or indirectly, (usually via Google or Microsoft) your own identity provider for authenticating.

Has anyone seen this issue or knows if there's a way to use passkeys within embedded browsers in macOS?

Thanks in advance!

Jose.

[lonoak]

Answering to myself, I see embedded webviews are marked unsupported in the passkeys.dev website, so I guess it's not yet in the priority list of OS vendors...

[timcappalli]

@lonoak So it is a bit complicated with services who use federated providers, which is why they are generically listed as not supported. EWV's run in a first party context to the calling app, so only passkeys that are bound to the web origin of the calling app can be used. This is by design as EWVs can modify all parts of the web content. You wouldn't want app A mucking with or observing passkey sign ins from origin B.

System WebViews (or popping a default browser) should be used in cases where you have multiple identity providers for sign in, as those providers may be using passkeys for sign in.

[lonoak]

Thanks @timcappalli.

I later realized these apps should better implement RFC 8252 BP for delegating authentication to the browser. I guess this would solve any security problems, as well not break passkeys.

[timcappalli]

passkeys.dev/device-support as well as the platform reference pages now include details about EWV and SWV support for passkeys.