-
Notifications
You must be signed in to change notification settings - Fork 26
Description
When attempting to create a new passkey with excludeCredentials containing an already registered credential ID, the expected behavior is for the creation to fail with an InvalidStateError and a clear explanation that the credential already exists. This is consistent with WebAuthn behavior in the browser when using navigator.credentials.create({ publicKey }).
Reproduction Steps:
- Register a passkey for a given user.
- Attempt to register a second passkey with the following publicKey options:
{
"excludeCredentials": [
{
"id": "Q6sgVvequT4p0WnfWyRdxCExJagxt_A7GbTMHbaeBtE",
"type": "public-key"
}
]
}
Expected Behavior:
The second passkey creation should fail with an InvalidStateError, explicitly stating that one of the provided credentials already exists for the relying party — just like it does in web browsers.
In web environments, when calling navigator.credentials.create({ publicKey }) with a credential ID that already exists in the excludeCredentials list, the following error is thrown:
InvalidStateError: The user attempted to register an authenticator that contains one of the credentials already registered with the relying party.
Actual Behavior:
The passkey creation correctly fails, but the error message is vague and lacks the reason:
errorCode: Passkey Create, message: androidx.credentials.exceptions.domerrors.InvalidStateError
This makes it difficult to distinguish this specific case (duplicate credential) from other types of InvalidStateError.
Could you improve the error handling to explicitly indicate when a credential ID provided in excludeCredentials already exists?
Environment
- Device: iPhone 13
- iOS version: 18.5
- react-native-passkeys version: 0.3.3
- react-native: 0.76.9 (old architecture)