UserVerificationRequirement registration and AuthN both preferred

src/main/java/org/springframework/security/webauthn/management/Webauthn4JRelyingPartyOperations.java

@@ -281,7 +281,7 @@ public PublicKeyCredentialRequestOptions createCredentialRequestOptions(Authenti
 				.challenge(Base64Url.random())
 				.rpId(this.rp.getId())
 				.timeout(Duration.ofMinutes(5))
-				.userVerification(UserVerificationRequirement.REQUIRED)
+				.userVerification(UserVerificationRequirement.PREFERRED)
 				.customize(this.customizeRequestOptions)
 				.build();
 	}

src/test/java/org/springframework/security/webauthn/management/Webauthn4jRelyingPartyOperationsTests.java

@@ -408,6 +408,13 @@ void registerCredentialWhenFmtNotValid() throws Exception {
 //		assertThatThrownBy(() -> this.rpOperations.registerCredential(registrationRequest)).hasMessageContaining("Flag combination is invalid");
 	}
 
+	@Test
+	void createCredentialRequestOptionsThenUserVerificationSameAsCreation() {
+		PublicKeyCredentialCreationOptions creationOptions = this.rpOperations.createPublicKeyCredentialCreationOptions(this.user);
+		PublicKeyCredentialRequestOptions credentialRequestOptions = this.rpOperations.createCredentialRequestOptions(this.user);
+		assertThat(credentialRequestOptions.getUserVerification()).isEqualTo(creationOptions.getAuthenticatorSelection().getUserVerification());
+	}
+
 	private static AuthenticatorAttestationResponse setFlag(byte... flags) throws Exception {
 		AuthenticatorAttestationResponseBuilder authAttResponseBldr = TestAuthenticatorAttestationResponse.createAuthenticatorAttestationResponse();
 		byte[] originalAttestationObjBytes = authAttResponseBldr.build().getAttestationObject().getBytes();