Ledger Security Key app does not populate `transports` in WebAuthn response

[HazardBaltazard]

Security Key version 1.6.5
Ledger Flex OS version: 1.2.2
Chromium version: 135.0.7049.95

When attempting to register my Ledger Flex as a WebAuthn (FIDO2) security key, the object returned by navigator.credentials.create() always contains:
"transports": []
According to the WebAuthn specification, this field should list at least one transport method (e.g. "usb", "nfc", or "ble").

Because it is empty, certain platforms (notably AWS IAM) reject the registration.

[iartemov-ledger]

Hello,

Thank you for your feedback.

My reading is that the transports field returned by authenticatorGetInfo operation appears only in CTAP v2.1 standard and only as optional one. In current WeAuthn standard (W3C Recommendation, 8 April 2021) it is sooner recommended than mandatory. So the clients or platforms should not reject the absent transports list unless they affirm supporting only >=CTAP v2.1.
With Ledger Security Key app we support only CTAP v2.0 so far.