excludeCredentials are not being excluded

[ioucyf]

I'm testing my implementation by adding a virtual authenticator via the WebAuthn tab in Chrome. The credential list gets populated whenever a registration is successful. However, every time I attempt to register the same user, it creates another without excluding the one that already exists. I do add the existing credential as shown in the documentation:

// Prevent users from re-registering existing authenticators
  excludeCredentials: userAuthenticators.map(authenticator => ({
    id: authenticator.credentialID,
    type: 'public-key',
    // Optional
    transports: authenticator.transports,
  }))

Yet, new credentials keep on being created every time regardless.

Note that the credentialIDs I'm saving to the user's data are of type Uint8Array while the IDs shown in the virtual authenticator are in strings. I also know that these Uint8Array can in fact be converted back into readable strings, yet that's not what the library returns. I'm wondering if I have to do the conversion myself or not?

[ioucyf]

Never mind. I figured it out. The credentialID was being "distorted" during DB insertion. Had to make sure it stores correctly.

I now, however, have another question: I tried storing the "string" version of the credentialID instead of the Uint8Array one, and that didn't work either. Does it only work when it's stored as Uint8Array?

[MasterKale]

This is in the browser, right? The id property needs to be a Uint8Array when defining excludeCredentials, as I do here in @simplewebauthn/browser:

https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/browser/src/helpers/toPublicKeyCredentialDescriptor.ts#L12

I currently use base64url to serialize bytes between the browser and server packages, but handle this however is best for your setup if you're not using browser for this.

[ioucyf]

Thank you so much for your reply and clarification!

Amazing library by the way! I love it! Thank you so much for making it. 🙏