Web Authentication API: PublicKeyCredential’s getClientCapabilities() method

[natiahlyi]

Request for Mozilla Position on an Emerging Web Specification

• Specification title: Availability of client capabilities - PublicKeyCredential’s getClientCapabilities() Method
• Specification or proposal URL (if available): https://w3c.github.io/webauthn/#sctn-getClientCapabilities
• Explainer URL (if available):
• Proposal author(s) (@-mention GitHub accounts):
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional): @jschanck
• WebKit standards-position: Added support for getClientCapabilities(). (119058559)

Other information

getClientCapabilities() method allows to determine which WebAuthn features are supported by the user's client. The method returns a list of supported capabilities, allowing developers to tailor authentication experiences and workflows based on the client's specific functionality.

[jschanck]

We're positive on this API. It provides a good alternative to error-prone ad-hoc feature detection. The spec acknowledges that some capabilities are a fingerprinting risk, but it leaves ample room for a compliant implementation to avoid exposing new data.