Open
Description
What is the user problem or growth opportunity you want to see solved?
WebAuthn will eventually replace TOTP as the recommended 2FA method, as it's more secure and easier to use.
The Commons app has dedicated logic for TOTP-based 2FA, and I imagine it likewise needs dedicated logic for WebAuthn-based 2FA.
Currently for users who have chosen WebAuthn, the clientlogin API will return a WebAuthnAuthenticationRequest after the password entry, rather than a TOTPAuthenticationRequest. The workflow might change slightly after T242031: Allow multiple different 2FA devices is finished.
(Corresponding Phabricator issue: T393329)
How do you know that this problem exists today? Why is this important?
No response
Who will benefit from it?
No response
Anything else you would like to add?
No response