Is it possible to block the "Scan this QR code..." feature

[ericlhopper]

There are use cases where a device can lose it's passkey and the server still has a key for the registered login. When we initiate an authentication in this instance, iOS presents a Sign In screen with "Scan this QR code...". For our use cases it would be better if the startAuthentication failed and the user was never presented with this option. Our users are confused by the QR code screen. Is this possible?

[MasterKale]

@ericlhopper Unfortunately no, nothing available in WebAuthn right now enables RP's to skip the QR code in, for example, Safari on iOS, macOS, and iPadOS. The transports property of an entry in allowCredentials during authentication is the official way for RP's to help browsers understand how they might communicate with an authenticator that'll recognize the credential ID. The spec does not, however, enforce how browsers should behave when they interpret the entries in allowCredentials.

If you compare Safari to Chrome's behavior, Chrome shows a "No passkeys available" message instead of defaulting to the hybrid QR code...

...however as you call out Safari across Apple's OS's believe it best to fall back to the QR code auth prompt. In the absence of transports I might be fine with this, but when ["internal"] are the only transports specified for an entry then I don't think it makes sense for Safari to prompt for hybrid auth if the platform authenticator doesn't recognize the credential.

For our use cases it would be better if the startAuthentication failed and the user was never presented with this option. Our users are confused by the QR code screen.

As a matter of fact I recently logged a WebKit bug for this very behavior that you might be interested in:

https://bugs.webkit.org/show_bug.cgi?id=261301