Clarify AuthenticatorSelection.RequireResidentKey vs ResidentKey

[hochhaus]

Is anyone able to clarify the difference between AuthenticatorSelection.RequireResidentKey and AuthenticatorSelection.ResidentKey?

Docs: https://pkg.go.dev/github.com/go-webauthn/[email protected]/protocol#AuthenticatorSelection

Commit: d973582

[james-d-elliott]

See the spec here: https://www.w3.org/TR/webauthn-2/#dictdef-authenticatorselectioncriteria

Both are valid, however requireResidentKey is a webauthn level 1 compatibility layer. Basically you should use residentKey unless you KNOW the browser only supports spec level 1.

[hochhaus]

Thanks @james-d-elliott. Your link to the spec clarifies it perfectly.

requireResidentKey ... Relying Parties SHOULD set it to true if, and only if, residentKey is set to required.