Intent to Prototype: Web Authentication Ambient UI

[Chromestatus]

Contact emails

ke...@chromium.org

Explainer

https://github.com/kenrb/webauthn/blob/main/explainers/ambient-sign-in.md

Specification

No information provided

Summary

This is a new mode for navigator.credentials.get() when used to sign a user into a website with a passkey or a password. Ambient is similar to Conditional Mediation (also called Conditional UI). It can be called by a page and UI will only be shown if the user has credentials. If the user has no sign-in credentials available, the promise will never resolve. The difference between Ambient and Conditional Mediation is that Ambient does not use autofill UI, and therefore does not require a login form be present on the page. Instead it provides the user a sign-in option as a non-modal suggestion. The intention is that the option should be clear enough that the user can recognize an opportunity for a low-friction sign-in, while unobtrusive enough that they can ignore it if they choose to. Ambient and Conditional Mediation are compatible. Credentials can be simultaneously made available in Ambient UI and autofill UI with a single JS call, if used on a page with a sign-in form.

Blink component

Blink>WebAuthentication

Web Feature ID

webauthn

Motivation

This is an enhancement to the WebAuthn API that is useful in the following situation: * A user is visiting a website for which they have a passkey available in a credential manager, but is not currently signed in to the site. * The user is viewing a page on the site that displays some type of content, and in particular is not a sign-in page. * The content being displayed by the site could be improved if the user was signed in to their account. Typically a website will have a link to the sign-in page displayed in, for example, a header menu. The user can click on that and proceed to complete a sign-in flow. At that point they can get the signed-in experience on the site. Some causes of friction in this experience include requiring the user to realize that they are not signed in and finding the UI to initiate it. This feature adds a mechanism for the site to prompt a sign-in without the user taking any specific action. An unobtrusive non-modal UI allows the user to ignore it if they don't want to sign in, and there is no UI show at all if the user has no credentials available. This is very similar to what WebAuthn already provides with Conditional UI, but it does not require a sign-in form to be present on the page. That difference allows low-friction sign-in options to be added to pages where sign-in forms would not be appropriate, or would be awkward to add.

Initial public proposal

https://github.com/w3c/webauthn/issues/2144

Goals for experimentation

None

Requires code in //chrome?

False

Tracking bug

https://issues.chromium.org/issues/532206357

Estimated milestones

No milestones specified

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5068149209825280?gate=5073275823718400

This intent message was generated by Chrome Platform Status.