Passkeys and WebAuthn

Tags: passkey, webauthn, ato, session

Checklist

• Find the ceremonies: Registration, assertion, and conditional UI. Note rpId, origin, and whether each call stays on the site you are testing.
• Account binding: See what a new credential attaches to: a logged-in session, an email proof, or an invite. A credential created before the account is verified is the case to write down.
• Credential inventory: List, rename, and remove passkeys as two users you own. User B should not be able to list or delete user A's credential ids.
• Recovery overlap: Password reset, magic link, backup code, and support unlock. Record whether any of them mint a session without a fresh proof on an account that was passkey-only.
• Cross-device finish: Hybrid and QR flows. The session that completes login should be the browser that started it, on an origin you control in the test.
• rpId and origin: Compare rpId, the page origin, and any related-origins list. A mismatch the server still accepts is a note, not an assumption.
• Session after assert: Record the cookie or token the assertion returns. Check logout, rotation, and whether an old session still works after that passkey is removed.
• Step-up on siblings: If a passkey is meant to gate payment, email change, or admin, try the same action on a sibling app or API and note whether the step is enforced there too.