Credential Management

Full Title

• This page is about the W3C CredentialManagement API which is often abbreviated as CredMan..
• This also is supported by Web Authentication and WebAuthn 2.

Context

• For general information about recovery or other topics see the web page Credential.

Problems Addressed

• Protection against phishing: An attacker who creates a fake login website can't login as the user because the signature changes with the origin of the website.
• Reduced impact of data breaches: Developers don't need to hash the public key, and if an attacker gets access to the public key used to verify the authentication, it can't authenticate because it needs the private key.
• Invulnerable to password attacks: Some users might reuse passwords, and an attacker may obtain the user's password for another website (e.g. via a data breach). Also, text passwords are much easier to brute-force than a Digital Signature

W3C API

The W3C Credential Management API is a standardized web API that streamlines the process of handling user credentials in a secure, user-friendly, and programmatically accessible way. It provides a common interface between a website and a browser’s built-in credential manager, making authentication—whether it’s signing in, saving new credentials, or even handling federated identities—much smoother for both developers and users.

1. Core Interfaces and Functions

- **Credential Interface:**

 This is the generic interface representing a user credential—essentially a piece of evidence that a user provides to prove their identity. It has derived types that cater to different authentication scenarios:
 - **PasswordCredential:** Used for traditional username/password combinations.
 - **FederatedCredential:** Used when the authentication is handled by an external identity provider (like Google or Facebook).  
 - **PublicKeyCredential:** Primarily utilized within the Web Authentication (WebAuthn) framework, often for multi-factor authentication or passkeys.
 - **OTPCredential (if supported):** For one-time password scenarios.

- **CredentialsContainer (navigator.credentials):**

 Accessible via `navigator.credentials`, this interface acts as the primary gateway to the credential manager. It exposes several key methods:
 - **create():** Generates a new credential, often by collecting data provided by the user through a form.
 - **store():** Saves a newly created or updated credential locally in the browser’s secure store, so it can be retrieved later.
 - **get():** Retrieves existing credentials from the browser, which can then be used to sign the user in automatically without them having to re-enter their details.

2. Security and Privacy Considerations

- **Secure Contexts:**

 The API is only available on secure origins (i.e., HTTPS), ensuring that sensitive credential data is handled in a secure environment.

- **User Consent and Interaction:**

 Although the API facilitates streamlined sign-in flows, user control remains paramount. For example, browsers typically only provide auto sign-in when the user has explicitly granted permission by previously saving credentials.

- **Cross-Device Synchronization:**

 Many browsers allow these stored credentials to be synchronized across devices (when the user is signed in with the browser account), thus maintaining a seamless experience even if the user switches devices.

3. Benefits and Use Cases

- **Seamless Sign-In:**

 Automatically retrieved credentials help reduce friction in authentication flows. Users can sign in with fewer clicks and less friction because the browser can pre-fill or even automatically submit stored credentials.

- **Enhanced User Experience:**

 By abstracting away the need for repetitive manual entry of usernames and passwords, the API paves the way for a more fluid and consistent user experience across sites and devices.

- **Federated and Multi-Factor Authentication:**

 With support for federated credentials and public key credentials, the API supports a variety of modern authentication mechanisms. This is particularly useful in environments that rely on multiple authentication factors or external identity providers.

- **Streamlined Credential Updates:**

 It offers a programmatic way to update or replace stored credentials, ensuring that changes (like a password update) are reflected in the browser's credential manager.

4. Developer Integration

- **Accessing the API:**

 Developers use the `navigator.credentials` object to interact with the API. For instance:
 
 ```javascript
 // Attempt to retrieve a stored credential
 navigator.credentials.get({password: true, federated: {providers: ['https://accounts.google.com']}})
   .then(credential => {
     if (credential) {
       // Use the credential to sign the user in
       console.log('Credential retrieved:', credential);
     }
   })
   .catch(error => {
     console.error('Credential retrieval error:', error);
   });
 ```

- **Adopting Best Practices:**

 Integration should always respect user privacy. Developers are encouraged to check for API support in the user’s browser (feature detection) and to use secure practices when handling sensitive data.

- **Improving Sign-In Flow:**

 The API is continuously evolving; by adhering to the W3C Credential Management Level 1 spec and keeping an eye on updates, developers can leverage this standardized approach to improve the security and usability of authentication on the web.

5. Standards and Specifications

- **W3C Working Draft:**

 The API is outlined in the Credential Management Level 1 specification by the World Wide Web Consortium (W3C). This document details the intended behavior, interface definitions, and security models for the API. It represents a community effort to establish a standard way of handling credentials across different platforms and browsers.

- **Interoperability:**

 The aim of the W3C Credential Management API is to create a uniform standard so that user agents (browsers) can consistently manage and access user credentials in a secure and seamless manner, ensuring interoperability between different websites and services.

Conclusion

The W3C Credential Management API provides a robust, secure, and user-centric approach to handling authentication credentials on the web. By offering methods to create, store, and retrieve various types of credentials, it helps reduce friction during sign-in processes while ensuring high standards of privacy and security. Its standardized approach facilitates a smoother integration of modern authentication strategies—ranging from traditional passwords to federated and public key credentials—ultimately enhancing the overall user experience.

Solutions

• For current bug list on blink see this site.
• Using Web Federated Identity to Authenticate Users Amazon WS
• Web Authentication API from Mozilla
• Web AuthN debug tab from Google
• Trust in self-sovereign-ID Condatus - SIOP and MS Authenticator
• Verifiable Credentials Preview by Azure AD from Microsoft