fix: use direct attestation for registration/authentication

[Bewinxed]

What kind of change does this PR introduce?

Fix/Enhancement

What is the current behavior?

The WebAuthn implementation currently sets attestation: 'none' in the default creation options, which means the authenticator doesn't provide any attestation statement during registration.
As per Yubico's Recommendation, this should be set to direct to allow us access to the make/model/version of the security keys being used. More Info

• Whether the authenticator is genuine (not a software emulator)
• The authenticator's make/model/manufacturer
• Whether it meets security requirements for the application

What is the new behavior?

Changed attestation from 'none' to 'direct' in DEFAULT_CREATION_OPTIONS.

Additional context

With attestation: 'direct', the server can Verify authenticator make/model and possibly reject unknown models using the AAGUID of the security key.

[github-actions]

🚀 Preview Release Status

false

---

_{Last updated: 2025-09-25T06:10:48Z}