iOS 18 FIDO2/WebAuthn Registration Not Triggering—Works on iOS 17.6.1 and Android

[abc910804]

Hi everyone,

I’m experiencing an issue with our FIDO2/WebAuthn registration process. Our implementation works fine on Android devices and on iOS 17.6.1, but on iOS 18 the registration process fails to trigger the WebAuthn API prompt.

We generate registration options using @simplewebauthn/server. For mobile devices (iOS), our options currently include parameters such as:

attestationType: 'none'
authenticatorAttachment: 'platform'
residentKey: 'required'
It appears that iOS 18 might enforce stricter requirements regarding these options, as the API prompt never appears on iOS 18. Has anyone encountered similar issues or discovered changes in iOS 18’s WebAuthn implementation that could be causing this behavior? Any suggestions on the proper parameter settings for iOS 18 would be greatly appreciated.

Thanks in advance!

[MasterKale]

@abc910804 can you please provide the entire value of optionsJSON you're passing into startRegistration()?

[abc910804]

Hi,

Here’s what I’m observing with my WebAuthn registration flow:
When using a PC to display a QR code that is scanned by a mobile device:
Both iOS 17 and iOS 18 fail to register.
Android devices register successfully.
When directly visiting the registration URL on a mobile browser:
iOS 17 devices register successfully.
iOS 18 devices still fail to register.
Additionally, PC registration using a security key works perfectly.

Below is the optionsJSON I’m receiving (from the PC side):
json
{
"rp": {
"name": "FIDO2 Server",
"id": "example.com"
},
"user": {
"id": "...",
"name": "exampleUser",
"displayName": "exampleUser"
},
"challenge": "xxxxx",
"pubKeyCredParams": [
{
"type": "public-key",
"alg": -7
}
],
"authenticatorSelection": {
"authenticatorAttachment": "cross-platform",
"userVerification": "preferred",
"residentKey": "preferred"
},
"timeout": 60000,
"attestation": "none",
"extensions": {}
}

This indicates that the backend is returning the PC-oriented options even when the request is coming from a mobile device (after scanning the QR code). I suspect that iOS 18 might have a different User-Agent or behavior causing my device-detection logic to fail, so that even when using a mobile device, the wrong options (with "cross‑platform") are returned.

Thanks in advance!