WebAuthn注册与可发现凭证治理（Resident Keys/用户验证）最佳实践

背景与价值注册阶段的策略决定凭证可用性与安全性。启用可发现凭证与用户验证可提升体验与抗钓鱼能力。统一规范可发现凭证：`residentKey` 设置为 `preferred` 或 `required`。用户验证：`userVerification` 设置为 `required`。受控策略：`rpId` 与 `attestation` 策略受控。核心实现注册选项与调用type CreateOpts = { rp: { name: string; id: string }, user: { id: Uint8Array; name: string; displayName: string }, challenge: Uint8Array, pubKeyCredParams: { type: 'public-key'; alg: number }[], authenticatorSelection: { residentKey: 'preferred' | 'required'; userVerification: 'required' }, attestation: 'none' | 'direct' } async function register(opts: CreateOpts): Promise<Credential | null> { if (!('credentials' in navigator)) return null const cred = await (navigator as any).credentials.create({ publicKey: opts }) return cred as any } 落地建议在注册阶段启用可发现凭证与强制用户验证，`rpId` 仅为受控域。根据合规策略选择 `attestation` 为 `none` 或受控 `direct` 并保存证明。验证清单是否启用 `residentKey` 与 `userVerification=required`；`rpId/attestation` 是否受控。