excludeCredentials ignored by iOS?

[Torsten85]

Hello,
I'm seeing some inconsistent behaviour regarding "excludeCredentials".

I've registered two devices to my account, one in chrome directly, one via QR code on iPhone (both logins work).

• When I try to register the chrome device again, chrome correctly shows the "Try a different device. You already registered this device" message.
• When I try to register via QR and iPhone again, it looks like the registration worked on the iPhone, but the QR code never disappears.
• When I try to register again via safari on mac (which uses the iPhone device bc of iCloud Sync), I get the "User clicked cancel, or the registration ceremony timed out" message

So the "excludeCredentials" seems to work as expected in chrome, but shows weird behaviour on iOS or Safari.

Is this an issue of this library or an incomplete implementation of the specs from apple?

Thanks in advance
Torsten

[MasterKale]

This reflects experiences I've had with excludeCredentials and Apple OS's. For some reason re-registration in Safari in iOS or macOS won't raise the expected "this device is already registered" error as Chrome correctly does (according to the spec). Instead they seem happy to overwrite an existing credential with an new one and otherwise act like a new registration. It's inconvenient from the RP's perspective.

As for what to do about it, there's not a whole lot you can do. I suppose you can track credential last-used date and if you notice a user using one all the time but another sits unused for months then you might have an overwritten credential on your hands. But there's tons of caveats even to this "basic" advice...