Conditional create on iPhone + Safari + Passwords violates the WebAuthn spec

WebAuthn Level 3 § 5.1.3 Step 22 Item 4 states the steps a user agent MUST follow when "conditional" mediation is used in conjunction with required user verification:

Let userVerification be the effective user verification requirement for credential creation, a Boolean value, as follows. If pkOptions.authenticatorSelection.userVerification

is set to required

  1. If options.mediation is set to conditional and user verification cannot be collected during the ceremony, throw a ConstraintError DOMException.
  2. Let userVerification be true.

On my iPhone 15 Pro Max running iOS 18.5, Safari + Passwords does not exhibit this behavior; instead an error is not reported and user verification is not performed (i.e., the UV bit is 0). Per the spec this results in a registration ceremony failure on the server which is made all the more "annoying" since the credential was created in Passwords forcing a user to then delete the credential. :

If the Relying Party requires user verification for this registration, verify that the UV bit of the flags in authData is set.

In contrast when I use Google Password Manager + Chrome on a Samsung Galaxy S24 running Android 15, user verification is enforced and the UV bit is 1.

Either the UV bit should be 1 after enforcing user verification or an error should be thrown since user verification cannot be performed.

A bug report was raised using Feedback Assistant. The number is 18839668. Here is the link

Conditional create on iPhone + Safari + Passwords violates the WebAuthn spec
 
 
Q