A secure context is a browser-approved web environment that meets security requirements for protected features such as WebAuthn. It matters because registration and login handle keys and authentication data that could be intercepted. section 15.3 section 15.4
Why double-clicking the HTML file fails
Opening a WebAuthn page directly from the filesystem does not provide the required secure context, so registration will not work. Serve the same page through localhost instead. For example, Java 21’s JDK can serve the current directory on port 8000, allowing the browser to start registration at localhost:8000. section 15.3
Use the secure pattern when testing protected browser features:
- Serve the page through a local web server rather than opening the HTML file directly. section 15.3
- Use localhost for local development; a local server is sufficient, without buying a domain or deploying an enterprise server. section 15.3
- Use HTTPS for deployed environments, because WebAuthn requires a secure context during registration and authentication. section 15.4
jwebserver --port 8000
Use the Java 21 JDK command to serve the current directory on port 8000, creating a localhost environment for WebAuthn testing. section 15.3
