Passkeys 6: account recovery and interaction with password reset #42

New Issue

2026-08-17T17:15:39-05:00

bermudalamb commented

2026-08-17 17:15:39 -05:00

Part of the Passkeys project. Parent: #36. Depends on #32 (password reset) and the authentication ceremony.

Scope

Define and implement what happens when a customer loses access to their authenticator, and how passkeys and passwords interact.

Questions this issue exists to settle

When a customer completes a password reset, are their passkeys left intact, or revoked? Revoking is safer if the account was compromised; keeping them is friendlier if they simply forgot a password.
Password reset already terminates all other sessions. Should it also terminate passkey-established sessions? (It should — they are the same customer_sessions rows, so this likely falls out for free, but it needs asserting rather than assuming.)
Is there any recovery path for a customer who has passkeys and has also lost access to their email?
If passkey-only accounts are ever offered, what replaces password reset as the recovery route?

Why this is a separate issue

Every other issue in this project adds a capability. This one is the safety net, and it is the piece most likely to be skipped under time pressure and most expensive to discover missing — a customer locked out of a real account with real order history.

Part of the Passkeys project. Parent: #36. Depends on #32 (password reset) and the authentication ceremony. ## Scope Define and implement what happens when a customer loses access to their authenticator, and how passkeys and passwords interact. ## Questions this issue exists to settle - When a customer completes a password reset, are their passkeys left intact, or revoked? Revoking is safer if the account was compromised; keeping them is friendlier if they simply forgot a password. - Password reset already terminates all other sessions. Should it also terminate passkey-established sessions? (It should — they are the same `customer_sessions` rows, so this likely falls out for free, but it needs asserting rather than assuming.) - Is there any recovery path for a customer who has passkeys and has also lost access to their email? - If passkey-only accounts are ever offered, what replaces password reset as the recovery route? ## Why this is a separate issue Every other issue in this project adds a capability. This one is the safety net, and it is the piece most likely to be skipped under time pressure and most expensive to discover missing — a customer locked out of a real account with real order history.

bermudalamb referenced this issue

2026-08-17 17:16:07 -05:00

Passkey (WebAuthn) login for customers #36

bermudalamb added this to the Passkey Implementation project 2026-08-17 17:21:31 -05:00

bermudalamb self-assigned this 2026-08-21 16:09:57 -05:00

bermudalamb referenced this issue from a commit

2026-09-09 16:03:49 -05:00

feat(passkeys): a password reset takes the passkeys with it (#42)

bermudalamb referenced a pull request that will close this issue

2026-09-09 16:04:09 -05:00

feat(passkeys): a password reset takes the passkeys with it (#42) #336

bermudalamb referenced this issue