WebAuthn Signal API Demo

Welcome to my Touhou fan site! It's super exclusive, so you need an account.

Sign in with your passkey

Don't have an account? Create one:

Username: Sign up!

Can't decide on a good username? Don't worry, you can change it later!

Demo instructions

Requirements:

• Chrome, ideally Canary for the latest version.
• Either of these:
  • Being signed in to your Google account (recommended).
  • Setting up a virtual authenticator with WebAuthn Devtools.

Instructions:

1. (Optional, but recommended): Run Chrome with --enable-features=WebAuthenticationSignalApiHidePasskeys.

   This makes the browser hide passkeys instead of permanentely deleting them. Hidden passkeys are deleted after about 30 days and show up on the password manager UI. The site can restore those passkeys, which could be useful if they got deleted by accident.

2. Set up your authenticator:
• Google Password Manager
1. Sign in to Chrome with a Google account.
2. When creating a passkey, choose "Google Password Manager" and follow instructions.
• DevTools:
1. Open Chrome DevTools.
2. Click the three button menu on the bottom (next to "Console") and select WebAuthn.
3. Click "Enable virtual authenticator environment".
4. Add a virtual authenticator with protocol ctap2, transport internal, supports resident keys true, supports user verification true.
3. Play with the buttons. Here are some things you can try:
   • Whenever you sign in or remove a credential, signalAllAcceptedCredentials is called. This should remove or hide any credentials removed by the user.
   • If you change your username, signalCurrentUserDetails is called and it should update your passkeys.
   • If you delete clear local storage and try to sign in, signalUnknownCredential is called.
   • Try undoing a passkey deletion. If your browser supports it (e.g. Chrome with --enable-features=WebAuthenticationSignalApiHidePasskeys), then it should be restored.

Important note

This site offers an "Undo" option specifically to help test restoring passkeys. However, relying parties should NOT generally support restoring after signalling that a passkey was deleted, since there is no way to know if an authenticator supports restoring passkeys in advance. The restore functionality is offered by browsers as a way to provide a recovery path in case the signal API is misused and user passkeys are deleted accidentally. Do not rely on the restore functionality being available.

This site is a test bed. Things are bound to break.

This website doesn't store anything on the server, so you can't try signing in with the same passkey from another browser instance. Go use Matt's site if you wanna do that.

Pixel art by code farmer: https://code-farmer.itch.io/touhou-pixe-characters, thank you so much! <3

Debugging

Clear local storage