Bind passkey enrollment to authenticated user

2026-09-03 12:40:20 -04:00
parent 92ef63ba00
commit 277cffed8c
8 changed files with 43 additions and 9 deletions
@@ -31,7 +31,9 @@ timestamp, UUID, or counter for the random challenge.
 2. A server-rendered enrollment page calls `BeginEnrollment`; the browser uses
   `navigator.credentials.create` with the returned `public_key` value.
 3. The browser posts the credential and opaque ceremony token to a bounded JSON
-   endpoint; `FinishRegistration` verifies and stores the public credential.
+   endpoint; authenticated self-service flows use
+   `FinishRegistrationForUser` so the application session's user ID is checked
+   before any public credential is stored.
 4. Login uses `BeginLogin`, `navigator.credentials.get`, and `FinishLogin`.
   The successful result contains an ordinary opaque `auth` session token.
 5. Sensitive operations call `BeginApproval` with a canonical application