fix: configuration to allow cross-platform devices for passkeys

[eadwu]

Related issue(s)

#4045

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

This aligns more with expected behavior. If one can sign in using cross platform devices, it doesn't make sense to restrict it to only devices within the same platform.

This is probably considered less secure when compared to the same-device restriction. https://www.passkeys.io allows cross-platform (or at least if this doesn't align it with theirs the behavior is more aligned with this change since I have not read hanko's source code)

[CLAassistant]

All committers have signed the CLA.

[aeneasr]

Would it be possible to add an e2e test for this in cypress or playwright?

@hperl do passkeys generally support this config value?

[eadwu]

I'm not exactly sure how to write tests in this repo.

I checked https://github.com/ory/kratos/pull/3748/files since I should really just be able to copy WebAuthn tests as passkeys only really put it in the device instead of storing it on the server (from what I know). If the tests for passkeys and webauthn don't have anything in relation to the authentication modality, I don't think I could write a test for it.

I'm not intimately familiar with the spec so I'm not sure about whether or not I can test it via cypress or playwright.

The difference is in what devices are allowed to connect. In the browser cross-platform is the QR-code while platform is only directly connected devices (unset allows both).

[aeneasr]

I‘m not confident that cross-platform is a valid method for „true“ passkeys. @hperl probably knows

[eadwu]

I found this https://passkeys.dev/docs/reference/terms/#cross-device-authentication-cda but yeah I'm not entirely sure either.

[aeneasr]

It does indeed look like this is OK:

https://passkeys.dev/docs/use-cases/bootstrapping/#cross-device-authentication