Comment by Gigachad
5 days ago
Allow email resets in the case of a lost domain. You could disable them in normal operation but in this case, any users with passkeys from the old domain can enroll a new one via email.
5 days ago
Allow email resets in the case of a lost domain. You could disable them in normal operation but in this case, any users with passkeys from the old domain can enroll a new one via email.
Does the passkey still serve a purpose in this scenario? Why not log them in by email and set a very long lived cookie so they don't have to log in often?
In my example reset by email has only been activated as a disaster recovery scenario where the site has lost it's domain. Under normal circumstances you would not enable it.