Repository navigation
Add passkey transport hints and challenge size samples - #388
Draft
StuFrankish wants to merge 2 commits into
Draft
StuFrankish wants to merge 2 commits into
StuFrankish wants to merge 2 commits into
Conversation
- Demonstrate automatic transport hint capture, storage, and known-user forwarding with application-owned verification\n- Show configurable challenge lengths and startup validation of the 16-byte minimum\n- Use public User Management preview 6 packages with in-memory SQLite and focused walkthroughs\n- Register both sample projects in the solution
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused samples match their documented scope, with no unresolved correctness or security issues identified.
No open issues 🎉
What changed in this PR
Adds two focused User Management samples for observing automatic passkey transport hints and configurable challenge lengths without adapting the full application sample.
Changes:
- Demonstrates transport-hint capture, persistence, and forwarding during signed-in verification.
- Displays decoded challenge lengths and documents defaults and minimum-size validation.
- Adds solution entries, local package overrides, and run instructions.
| File | Description |
|---|---|
| samples.slnx | Adds both sample projects. |
| IdentityServer/v8/UserManagement/TransportHints/wwwroot/sample.css | Styles the transport demonstration. |
| IdentityServer/v8/UserManagement/TransportHints/TransportHints.csproj | Pins previews and links GettingStarted sources. |
| IdentityServer/v8/UserManagement/TransportHints/SignedInUserResolver.cs | Resolves the authenticated subject. |
| IdentityServer/v8/UserManagement/TransportHints/README.md | Documents transport observations and limitations. |
| IdentityServer/v8/UserManagement/TransportHints/Properties/launchSettings.json | Sets the local HTTPS endpoint. |
| IdentityServer/v8/UserManagement/TransportHints/Program.cs | Configures authentication and in-memory storage. |
| IdentityServer/v8/UserManagement/TransportHints/Pages/Shared/_Layout.cshtml | Provides the sign-in layout. |
| IdentityServer/v8/UserManagement/TransportHints/Pages/Index.cshtml.cs | Verifies passkeys without changing sessions. |
| IdentityServer/v8/UserManagement/TransportHints/Pages/Index.cshtml | Displays transport metadata across ceremonies. |
| IdentityServer/v8/UserManagement/TransportHints/Pages/Account/_ViewStart.cshtml | Applies the account-page layout. |
| IdentityServer/v8/UserManagement/TransportHints/Pages/_ViewImports.cshtml | Enables Razor tag helpers. |
| IdentityServer/v8/UserManagement/ChallengeSize/wwwroot/sample.css | Styles challenge inspection. |
| IdentityServer/v8/UserManagement/ChallengeSize/README.md | Documents challenge sizes and validation. |
| IdentityServer/v8/UserManagement/ChallengeSize/Properties/launchSettings.json | Sets the local HTTPS endpoint. |
| IdentityServer/v8/UserManagement/ChallengeSize/Program.cs | Configures challenge size and in-memory storage. |
| IdentityServer/v8/UserManagement/ChallengeSize/Pages/Shared/_Layout.cshtml | Provides the inspection-page layout. |
| IdentityServer/v8/UserManagement/ChallengeSize/Pages/Index.cshtml.cs | Begins ceremonies and measures challenges. |
| IdentityServer/v8/UserManagement/ChallengeSize/Pages/Index.cshtml | Displays configured and decoded lengths. |
| IdentityServer/v8/UserManagement/ChallengeSize/Pages/_ViewStart.cshtml | Applies the shared layout. |
| IdentityServer/v8/UserManagement/ChallengeSize/Pages/_ViewImports.cshtml | Enables Razor tag helpers. |
| IdentityServer/v8/UserManagement/ChallengeSize/ChallengeSize.csproj | Defines the project and preview overrides. |
| IdentityServer/v8/UserManagement/ChallengeSize/appsettings.json | Sets explicit 64-byte challenges. |
Review effort: Balanced
maartenba
approved these changes
Oct 19, 2026
- Cite the WebAuthn entropy guidance and explain Duende's minimum and default challenge sizes - Define transport hints and describe their role in authenticator discovery
maartenba
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds focused samples for User Management's automatic passkey transport hints and configurable challenge length, so users can observe these features without adapting the full application sample.
Approach
2.0.0-preview.6, IdentityServer8.1.0-preview.6, and SQLite Storage2.0.0-preview.6, with project-local overrides. Shared versions and NuGet configuration are unchanged.Both stores are in-memory and discard data on restart. TransportHints has documented build-time dependencies on sibling GettingStarted sources. Transport hints are optional browser UX metadata, not a security policy or configurable allow-list.
Validation
OptionsValidationException:Passkeys.ChallengeSize must be >= 16, but was 15.No test projects or validation scripts are added to the repository. Cookie challenge stores and cryptographic extension implementations are outside this change.