Experience from trying out WebAuthn

[janko]

I decided to finally play around with the WebAuthn integration, and I was very impressed with how integrated the whole experience was 😊

I was mainly curious if it happens to support Passkeys, and was pleased to see it does; I assume it comes automatically with supporting WebAuthn. Eventually, I would like to investigate adding support for autocompletion as shown on WebAuthn.io:

One thing that I found a bit confusing was the text field that comes with setup & auth forms. At first I thought I should fill something in there, but then I realized it's automatically filled in with my credentials after WebAuthn interaction. I'm not sure if that field is visible for testing purposes, but I wanted to propose making that field hidden, so that it's clear to the developer that they only need to click the submit button. What do you think?

Also, I found one auth method named webauth_credential_options_for_get, which has webauth instead of webauthn. I was thinking of sending a PR to rename it, deprecating the current one, for consistency. Does that sound reasonable?

[jeremyevans]

Thanks for trying the support out.

Supporting autocompletion sounds like a good idea.

The user of Rodauth should use CSS to hide the related webauth input fields. Rodauth never directly includes CSS styling for inputs. It does set the rodauth_hidden class on the input, as well as the aria-hidden attribute. However, keeping with current Rodauth practice, I would be OK adding another class to make it hidden by default when using Bootstrap.

Renaming webauth_credential_options_for_get also sounds like a good idea.