WebauthnFailure
: string
in package
A ceremony failure a caller can say something useful about (CONTRACT.md §24.6b rule 5).
This SDK ships no linked-API helper — PHP runs on a server, which has no authenticator, and
§24.6b rule 2 forbids emulating one — but the classification is still required of it: the
browser half of a PHP relying party catches a DOMException and relays its name, and it has
the same five outcomes and the same reason to want one vocabulary for them.
Table of Contents
Cases
- AlreadyRegistered = 'already_registered'
- The authenticator already holds a credential for this account and refused to silently mint a second — the exclusion list working, not a failure. The only classification whose remedy is "use a different device".
- Cancelled = 'cancelled'
- Covers **both** an explicit refusal and a silent timeout.
- Timeout = 'timeout'
- An explicitly aborted ceremony.
- Unknown = 'unknown'
- Everything else.
- Unsupported = 'unsupported'
- This device or browser cannot run the ceremony.
Methods
- classify() : self
- Map a platform ceremony error name to its canonical classification.
- message() : string
- Copy for this failure, safe to show a user.
Cases
Cancelled
Covers **both** an explicit refusal and a silent timeout.
The WebAuthn spec deliberately refuses to distinguish them, because telling a website which one happened leaks whether an authenticator was present. It must not be recovered by timing the call.
AlreadyRegistered
The authenticator already holds a credential for this account and refused to silently mint a second — the exclusion list working, not a failure. The only classification whose remedy is "use a different device".
Timeout
An explicitly aborted ceremony.
Unsupported
This device or browser cannot run the ceremony.
Unknown
Everything else.
Methods
classify()
Map a platform ceremony error name to its canonical classification.
public
static classify(string|null $name) : self
Every platform reports a ceremony failure as one opaque type whose only machine-readable part is a name, so a browser can relay just that name and a PHP relying party turns it into the same five outcomes. Anything unrecognised is self::Unknown rather than a throw — a classifier that can fail is one more thing for an error handler to handle.
Parameters
- $name : string|null
Return values
selfmessage()
Copy for this failure, safe to show a user.
public
message() : string
The self::Cancelled string deliberately does not accuse anyone of cancelling: the same classification covers a silent timeout, and the spec will not say which happened.