2

What is the best practice for allowing users to reset a passkey (WebAuthn)?

Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In addition, is there best practice way of allowing users to login to a new device without a synced passkey.

1 Answer 1

1

Users can have multiple Passkeys setup in their account. So, "Passkey Reset" might not be possible as you'll not know which Passkey user wants to reset before login.

One way would be to login users by other means like email with OTP or password with OTP in email (depends on the security requirements). Once they are logged in, they should be able to delete previous Passkeys and create new ones.

2
  • I guess the equivalent of a password reset would be to add a new passkey on the current device and potentially remove the old one
    – reesericci
    Mar 8 at 16:07
  • @reesericci there can few options to implement that; however, imo a simple solution would be to just let users login and they can add/remove Passkeys from the Settings page. Mar 9 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .