Safari 18.0.1 on macOS 15.01 doesn't support the Passkey PRF extension during cross-device WebAuthn authentication when using QR code scanning, while it works correctly with iCloud passkeys.
Steps to Reproduce:
Clone and setup:
git clone https://github.com/quocle108/passkey-prf-test
yarn
yarn start
Test iCloud Passkey Flow:
Open http://localhost:3000 in Safari
Open DevTools (Cmd+Option+I)
Click "Register"
Choose "Passkey on iCloud"
Expected console output: PRF supported: true
Test Cross-Device Flow:
Click "Register"
Choose "Phone/Tablet"
Scan QR with mobile device
Expected: PRF supported: true
PRF extension should be supported in cross-device flow, matching iCloud passkey behavior.
Actual: PRF supported: false
Cross-device flow returns empty extension results.
Verify in Chrome
Repeat steps 2-3 in Chrome
Both flows return proper PRF extension results: PRF supported: true
Test Environment:
Browser: Safari 18.1.1 , Chrome 131.0.6778.70
OS: macOS 15.01
Mobile: iOS 18.x / Galaxy Note9 Android 10
Test repo: https://github.com/quocle108/passkey-prf-test
ConChimNon
Users receive reputation points by contributing quality content to the forums.
Posts include post and replies published on the forums.
Post authors can mark replies as Accepted to indicate successful solutions.
Apple Developer Forums admins can mark replies as Apple Recommended to indicate an approved solution
Post
Replies
Boosts
Views
Activity
Test Scenario:
Initial Setup:
Register a passkey on Chrome (MacBook) with cross-platform option
The passkey syncs to iPhone via iCloud
Both devices share same iCloud account
Authentication Tests:
Chrome on MacBook:
Using hybrid transport (QR code with iPhone) → PRF output A
Using platform authenticator → PRF output B (different)
Safari on MacBook:
Only uses platform authenticator → PRF output B
Expected Behavior:
When using same credential ID and salt, PRF output should be consistent across browsers/devices