What are allowCredentials in WebAuthn?

What are allowCredentials in WebAuthn?#

In WebAuthn, allowCredentials is a crucial field in the PublicKeyCredentialRequestOptions object (in developer forums, it's also often called allowList or WebAuthn allowList). It's used during the authentication (login) process to specify which registered credentials can be used to authenticate a user. This field contains a list of PublicKeyCredentialDescriptor objects, indicating acceptable public key credentials to the Relying Party (RP). Its significance lies in:

• Selective Authentication: Directs the authenticator to use specific credentials
• Credential Preferences: Credentials are listed in descending order of preference, guiding the client in selection.
• Enhanced User Experience: Streamlines the authentication process by guiding the client on which credentials to use, reducing user input.

Key Takeaways#

---

The allowCredentials field in WebAuthn plays a pivotal role in defining a secure and efficient authentication flow. By specifying which credentials are acceptable, it ensures that the authentication process is both secure and user-friendly.

Detailed Insights:#

• User-Centric Authentication: Tailors the authentication process to individual users by allowing the selection of specific credentials.
• Role in Authentication Flow: Informs the client (such as a browser or mobile app) which credentials are acceptable, particularly important when the user has multiple credentials registered.
• Technical Implementation: For developers, understanding how allowCredentials influences the authentication flow is crucial for building robust WebAuthn implementations.

---

allowCredentials FAQs#

What is the purpose of allowCredentials in WebAuthn?#

allowCredentials specifies which registered credentials can be used for user authentication, guiding the client in the authentication process.

How does allowCredentials enhance security and user experience in WebAuthn?#

It enhances security by specifying exact credentials for authentication, and improves user experience by streamlining the credential selection process.

What are the implications of not providing an allowCredentials list in WebAuthn?#

Without an allowCredentials list, the client may not know which specific credential to use, leading to additional user interaction to select the appropriate credential.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →