> And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it

> And Safari for example requires user gestures for navigator.credentials.get(), so if you were thinking of redirecting users to a /login/verify/ page where it will automatically prompt for a WebAuthn verification, you actually need Safari users to click on a button on that page. On other browsers, you can basically just pop up the WebAuthn prompt automatically on page load. This is something that is being changed in the standard that user action will be required. Safari just implemented it first. The problem is that without prompting things like FaceID on the iPhone are so fast that you may get logged in without knowing if there is no user action required.