Deprecate Authenticator Attachment in favor of Hints #2383
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
akshayku
requested review from
MasterKale,
emlun,
nsatragno,
timcappalli and
ve7jtb
akshayku
commented
Jan 28, 2026
timcappalli
reviewed
Jan 28, 2026
timcappalli
reviewed
Jan 28, 2026
Co-authored-by: Tim Cappalli <tim@cloudauth.dev>
Co-authored-by: Tim Cappalli <tim@cloudauth.dev>
MasterKale
reviewed
Jan 28, 2026
| <div dfn-type="dict-member" dfn-for="AuthenticatorSelectionCriteria"> | ||
| : <dfn>authenticatorAttachment</dfn> | ||
| :: If this member is present, eligible [=authenticators=] are filtered to be only those authenticators attached with the specified | ||
| :: Note: This member is deprecated in favor of {{PublicKeyCredentialCreationOptions/hints}}. [=[RPS]=] SHOULD use {{PublicKeyCredentialHint/client-device}} instead of {{AuthenticatorAttachment/platform}}, and {{PublicKeyCredentialHint/security-key}} and/or {{PublicKeyCredentialHint/hybrid}} instead of {{AuthenticatorAttachment/cross-platform}} for [=registration ceremony|registration=]. |
Contributor
There was a problem hiding this comment.
Hints support ordering by preference, a nuance that's not currently captured in this value-mapping guidance. I'd rather the nuance be thoroughly explained in the section on User-agent Hints Enumeration, but perhaps here we can simply mention it:
Suggested change
| :: Note: This member is deprecated in favor of {{PublicKeyCredentialCreationOptions/hints}}. [=[RPS]=] SHOULD use {{PublicKeyCredentialHint/client-device}} instead of {{AuthenticatorAttachment/platform}}, and {{PublicKeyCredentialHint/security-key}} and/or {{PublicKeyCredentialHint/hybrid}} instead of {{AuthenticatorAttachment/cross-platform}} for [=registration ceremony|registration=]. | |
| :: Note: This member is deprecated in favor of {{PublicKeyCredentialCreationOptions/hints}}. [=[RPS]=] SHOULD use {{PublicKeyCredentialHint/client-device}} instead of {{AuthenticatorAttachment/platform}}, and {{PublicKeyCredentialHint/security-key}} and/or {{PublicKeyCredentialHint/hybrid}} (ordered by decreasing preference) instead of {{AuthenticatorAttachment/cross-platform}} for [=registration ceremony|registration=]. |
|
|
||
| ### Authenticator Attachment Enumeration (enum <dfn enum>AuthenticatorAttachment</dfn>) ### {#enum-attachment} | ||
|
|
||
| Note: Authenticator Attachment is being deprecated in favor of {{PublicKeyCredentialHint}}. The {{AuthenticatorAttachment/platform}} value is superseded by {{PublicKeyCredentialHint/client-device}}, and {{AuthenticatorAttachment/cross-platform}} is superseded by {{PublicKeyCredentialHint/security-key}} and {{PublicKeyCredentialHint/hybrid}}. [=[RPS]=] SHOULD use {{PublicKeyCredentialCreationOptions/hints}} instead of {{AuthenticatorSelectionCriteria/authenticatorAttachment}}. |
Contributor
There was a problem hiding this comment.
I have a similar note here: without mentioning the ability to order hints by preference, it'll look to RPs like they must specify cross-platform hints as ["security-key", "hybrid"] when it's totally valid to specify them as ["hybrid", "security-key"] if an RP's preferences deemed it more appropriate.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #2053
The following tasks have been completed:
Implementation commitment:
Documentation and checks