YubiKey Nano 5C Not Detected

[skeet70]

This is on a Mac on a WebKit browser with a YubiKey Nano 5C plugged in. On https://webauthn.io both TouchID and the YubiKey can be registered. On my implementation using:

generateRegistrationOptions({
    rpName: WEBAUTHN_RP_NAME,
    rpID: WEBAUTHN_RP_ID,
    userName: request.auth.credentials.email,
    attestationType: "none",
    excludeCredentials: userPasskeys.map((passkey) => ({
        id: passkey.id,
        transports: passkey.transports,
    })),
    authenticatorSelection: {
        residentKey: "preferred",
        userVerification: "preferred",
    },
})

even with no currently registered device the YubiKey is never triggered to be able to register. If I click "Use security key" (like I do on webauthn.io on the same browser), the YubiKey doesn't start flashing to be pressed.

TouchID registration and authentication works with no issue, though once it has been registered, clicking "Use security key" during registration (instead of TouchID) immediately fails, triggering the InvalidStateError handler, which also seems like it's connected to the YubiKey not being detected.

On the same Mac with Brave browser the problem is inverted and only the YubiKey works/is prompted for, TouchID is never an option.

[MasterKale]

Hello @skeet70, this is strange behavior, but I'm recreating it locally in macOS Safari so it's not just you 🤔

At what URL are you using generateRegistrationOptions()? Something served at http://localhost:port? I'm getting the feeling that something is wrong with security key registration in WebKit when using WebAuthn locally...I'll ask around in the morning and see if anyone else has heard of this as I can't see anything about this in the WebKit bug tracker.

[skeet70]

Yes, localhost:4500. The RP constants are localhost and http://localhost:4500.

…

-------- Original Message --------

On 5/12/25 22:36, Matthew Miller wrote: Hello ***@***.***(https://github.com/skeet70), this is strange behavior, but I'm recreating it locally in macOS Safari so it's not just you 🤔 At what URL are you using generateRegistrationOptions()? Something served at http://localhost:port? I'm getting the feeling that something is wrong with security key registration in WebKit when using WebAuthn locally...I'll ask around in the morning and see if anyone else has heard of this as I can't see anything about this in the WebKit bug tracker. — Reply to this email directly, [view it on GitHub](#696 (comment)), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/AAK3V5JDWI4MJNEY6NG2AFL26FZEXAVCNFSM6AAAAAB47LE4VGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGMJSGYYTCMA). You are receiving this because you were mentioned.Message ID: ***@***.***>