The right way to use YubiKey as an authenticator

[yilanboy]

Hi!

First, I want to thank this project, I use this project to implement the passkey login in my blog repo.

But I have a question, I find that default counter check won't accept my YubiKey as an authenticator.

I have to create a custom counter check and update the check rule. The default rule is...

$currentCounter > $publicKeyCredentialSource->getCounter()

I find in YubiKey, current counter will always equal to credential source counter, if I want to use YubiKey as an authenticator, I must change the rule to...

$currentCounter >= $publicKeyCredentialSource->getCounter()

But I think this might break the purpose of counter check, I'm really confusing about the mechanism behind it.

Is there anyone can tell me I was wrong in something?