Post #2569830

fedi, question: Passkey registration happens in two stages. You request a challenge, then send back the response. The server needs to track this somehow. The challenge does not contain anything that I could use to tie the challenge and response together. You get a session and options from the call to start the registration on the server side. Is there any scenario in which you can hand the session over to the client and still be certain that, on response to the challenge, you got the original session? Would it be easier to simply throw the session into the server's database and fetch it again later?