Method MapPasskeyPage

MapPasskeyPage(IEndpointRouteBuilder, string, Action<PasskeyPageOptions>?)

Maps the passkey hand-off page, which runs a WebAuthn ceremony in the system browser for apps that cannot run it themselves (such as native apps) and returns the credential to the app's callback address.

Declaration

public static IEndpointConventionBuilder MapPasskeyPage(this IEndpointRouteBuilder endpoints, string pattern = "/passkey", Action<PasskeyPageOptions>? configure = null)

Parameters

Type	Name	Description
IEndpointRouteBuilder	endpoints	The endpoint route builder.
string	pattern	The route of the page. Its script and stylesheet are served under it.
Action<PasskeyPageOptions>	configure	An action that configures the page options, such as the custom schemes allowed in callback addresses.

Returns

Type	Description
IEndpointConventionBuilder	A builder for adding conventions to the page's endpoints.

Remarks

The page is opened with {pattern}?op={get|create}&options={options}&redirect={callback}&state={state}, where options is the base64url (without padding) encoding of the UTF-8 options JSON of a ceremony (OptionsJson), redirect is the app's callback address and state is an optional value of at most 256 characters. When the user continues, the page runs the ceremony and navigates to the callback address with state and either credential (the base64url encoding of the UTF-8 credential JSON) or error (the name of the error, such as NotAllowedError, or AbortError when the user cancels) and message added. The page makes no requests of its own: the app gets the options from its API and posts the credential back to it.

The page must be served from an origin that is in AllowedOrigins and whose host is the relying party ID or a subdomain of it, for example an API at https://api.example.com for the relying party ID example.com. It is excluded from API descriptions, and is sent with a strict content security policy and no caching.