Repository navigation
U2F support in the future versions of Chrome #423
Description
Hi,
Today I have seen in my JS console the following warning while I was logging in using my Yubikey:
The U2F Security Key API is deprecated and will be removed soon. If you own this website, please migrate to the Web Authentication API. For more information see https://groups.google.com/a/chromium.org/g/blink-dev/c/xHC3AtU_65A/m/yg20tsVFBAAJ
It means that in the next year security keys won't work at all with your plugin?
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
innertruth commentedon Nov 20, 2021
I don't get this message in the JS Console, I get a dialog for this message with the same text asking to block or give access. But issue 232 is I think a solution for this, maybe the maintainer can merge the code and 'bake' a new release.
BackSeat commentedon Nov 25, 2021
I'm seeing this as a popup rather than in the JS console.
Is this likely to be resolved before 1 February?
Thanks.
dziudek commentedon Nov 25, 2021
@BackSeat - I can confirm - after latest Chrome update (v.96) I also get the notice about February 2022
westonruter commentedon Nov 29, 2021
I just got it as well:
blogtutor commentedon Nov 30, 2021
Is anyone on the plugin development team aware of this issue yet? Looks like it's going to be a big mess come February, if the plugin isn't changed over to the Web Authentication API by then.
bemyhre commentedon Nov 30, 2021
This is an issue for me, as well. It sounds like this plugin will become useless for me in Feb. Even now, I cannot register my key on new things.
timarney commentedon Dec 6, 2021
Noting a few folks have posted here here as well:
https://wordpress.org/support/topic/u2f-api-deprecation-message/
pjv commentedon Dec 22, 2021
Google documentation for the deprecation: https://groups.google.com/a/chromium.org/g/blink-dev/c/xHC3AtU_65A
This will break logging in to wordpress for anyone using this plugin with a U2F security key in a chromium-based browser after February.
supawiz6991 commentedon Jan 11, 2022
Any update on this? We are currently 3 weeks from February...not knowing when the update will be hitting that will remove the U2F API means we could be in a real mess sooner than later.
kasparsd commentedon Jan 11, 2022
I personally haven't had time to work on this, unfortunately.
The tricky thing is that the the two-factor plugin is currently available on both WP.org and Packagist.org which mirrors this source repo, however, adding webauthn will probably need some helper JS libraries to be added via npm (along with build tooling) so we'll need to either keep tracking the built assets as part of the repo or create a dedicated release repo which contains the built assets and map it to the Packagist source.
Happy to support with reviewing a pull request if anyone is up for creating one.
Relating this to #232.
kasparsd commentedon Jan 11, 2022
Here is some existing art from @mcguffin https://github.com/mcguffin/two-factor-webauthn
Looks like we'll need to pull in both external JS and PHP dependencies (and potentially even PHP extensions) for this to work.
mcguffin commentedon Jan 21, 2022
@kasparsd I'd be happy to craft a PR.
I just managed to get rid of one of the large dependencies in mcguffin/two-factor-webauthn. The other ones are aesy to refactor. The PR should introduce about 2k new lines of PHP and 500 lines of JS.
Minimum PHP would increase to 7.2 (according to phpcompatinfo), but luckily there are no other php extensions necessary as the ones WP requires anway.
norbusan commentedon Jan 21, 2022
Just FYI, since I am using Edge Beta I am already hit by the deprecation. I have added Wp-WebAuthn plugin and that allowed me to log in via direct webauthn authentication via my yubikey, while this plugin is still active. This might be an alternative route.
41 remaining items
adampl commentedon Oct 14, 2025
is WebAuthn ever going to be implemented?
masteradhoc commentedon Feb 28, 2026
Hey everyone
We'll remove U2F support finally in 0.16.0. We'll track the Support of WebAuthn in #427 and a discussion to migrate U2F Keys to WebAuthn in #491 soon as well. Thanks everyone for your patience.