Support passwordless account creation

[rolandVi]

Builds on #68522.

You can now sign up on the Blazor template with a passkey and no password. Today the register page insists on a password, so the only route to a passkey is to invent one first, sign in, and go find the manage page.

Design notes

Registration gets its own anonymous endpoint rather than relaxing /Account/Manage/PasskeyCreationOptions, which stays behind RequireAuthorization() and the reauthentication check. It never looks up an existing account: reusing one's ID would let anyone type your address, make a passkey, and have it attached to your account.

The address runs through the same validators CreateAsync uses before any options go out, so a taken one is refused before you are asked for a fingerprint and left holding a passkey the server never stored.

Login page fix

Login.razor is in here too. Both ceremonies keep their state in one shared cookie, and the login page starts one by itself for autofill, so two tabs can collide, which throws instead of failing and gives a 500. That was hard to hit before. With Register one click from Login, it is not.

Resolves #67297.

[rolandVi]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
4 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

🟡 Changes recommended

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Enables passwordless (passkey-first) registration in the Blazor “Individual Accounts” template by adding a dedicated anonymous passkey registration-options endpoint and wiring the Register page to initiate a WebAuthn attestation flow without requiring a password. It also hardens the Login flow against passkey ceremony-state collisions (multi-tab) that can otherwise surface as 500s.

Changes:

• Add passkey-based registration flow (client + server) and UI entry point on /Account/Register.
• Add an anonymous /Account/PasskeyRegistrationOptions endpoint that validates the email before starting the ceremony.
• Fix passkey login to handle ceremony cookie collisions gracefully; expand template test coverage for passkey-only accounts.

File summaries

File	Description
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Shared/PasskeySubmit.razor.js	Adds “Register” ceremony support and improves server error surfacing for fetch calls.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/PasskeyOperation.cs	Adds Register enum value for passkey-submit operation selection.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Pages/Register.razor	Adds “Sign up with a passkey” path and server-side handler for creating the account around the attested user handle.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/Pages/Login.razor	Prevents 500s by handling passkey ceremony-state collisions as a user-facing “session expired” error.
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Components/Account/IdentityComponentsEndpointRouteBuilderExtensions.cs	Adds /PasskeyRegistrationOptions endpoint that validates email and runs UserValidators before returning creation options.
src/ProjectTemplates/test/Templates.Blazor.Tests/BlazorTemplateTest.cs	Adds an E2E scenario covering passkey-only registration and subsequent sign-in behavior.
src/Identity/Core/src/SignInManager.cs	Clarifies guidance in XML docs around “initial credential” vs adding passkeys to existing accounts.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[rolandVi]

/azp run aspnetcore-ci

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[github-actions]

⚠️ Documentation appears necessary, but a draft PR could not be created.

Confidence that documentation is needed: 75%

Documentation is likely needed (template behavior change), but an existing docs PR (#37773 on branch docs/aspnetcore-pr-68648) matches this source and is untrusted/blocked, so it can't be modified or replaced. No draft was created; human follow-up is needed.

Documentation surfaces considered

• Conceptual article: Required — The Blazor Web App template gains passwordless passkey registration (new anonymous PasskeyRegistrationOptions endpoint, changed Register.razor, PasskeyUpgrade.razor, Login.razor), which is generated-app behavior that the Identity/passkey docs should cover for 12.0.
• Migration guidance: Not required — New templates only; existing apps need no action, and no upgrade recommendation is evident.
• Breaking change: Not required — No removed APIs or changed defaults for existing apps; the change affects newly generated template content.