Optional userId & userName

[GrandSchtroumpf]

Maybe I'm mistaken but we could make userId & userName optional in generateRegistrationOptions.

The current flow looks like :

1. Requesting the HTML page /signup
2. Enter the name & request option /signup/challenge
3. Get credentials & send for verification /signup/verify

But as the challenge doesn't really need the userId & userName, we could save ourselves a request by sending the challenge alongside the HTML page :

1. Requesting the HTML page + challenge /signup
2. Get credentials & send for verify /signup/verify

[MasterKale]

I'm disinclined to make those arguments for generateRegistrationOptions() optional because they're required in the spec. However, as an RP, you could generate a random user ID for userId and use a junk value for userName, and then replace userName client-side once the user enters their desired username.

I personally wouldn't advocate for this because what if you have a username collision? The submission of a value for userName gives you a chance to enforce the uniqueness of usernames (if that's desirable).

But as the challenge doesn't really need the userId & userName, we could save ourselves a request by sending the challenge alongside the HTML page :

Especially in passkey-oriented flows userId and userName are very important to provide the authenticator up-front because they get used to persist the credential internally. hash(RP ID) + user ID are used internally by an authenticator to map a user's credential to a website, and userName is often stored as metadata for that credential so that the authenticator can show you the username later when you log in with a credential to confirm the account you'll be logging in as.

Hope that helps.

[GrandSchtroumpf]

It definitely helps a lot. Thanks for the detailed answer.