Nice! Thank you @tcannonfodder! And sorry for the late response 😥

I think this is a good idea to add some documentation on how to require user_verification for the cases where developers use this gem in a password-less login!

Although adding user_verification: true to the verify method is correct, we should also add some documentation about how to set the user_verification in the PublicKeyCredential::Options to be required in the initiation phase of both Credential Authentication and Registration ceremonies – see the docs. That is because, as for a password-less login you will be requiring UV, you will want the authenticators that don't support UV to not be eligible to be used instead of letting them be used and then raise a verification error. In order to do that you can do:

• In the initiation phase of the Credential Registration ceremony:

options = WebAuthn::Credential.options_for_create(
  ...,
  authenticator_selection: { user_verification: "required" }
)

• In the initiation phase of the Credential Authentication ceremony:

options = WebAuthn::Credential.options_for_get(
  ...,
  user_verification: "required"
)

We had an old PR opened in webauthn-rails-demo-app – which implements a password-less login using webauthn – for adding user verification which I revisited and merged after seeing this issue/PR. You can check it to see how we did to add this and maybe even try it if you want 🙂