feat/backup-state #195
Merged
feat/backup-state #195
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MasterKale
added
enhancement
MasterKale
force-pushed
the
feat/backup-state
branch
from
341e94f
to
81e1909
Compare
MasterKale
force-pushed
the
feat/backup-state
branch
from
81e1909
to
eab6ae4
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for the new "Backup Eligibility" and "Backup State" flags being introduced in w3c/webauthn#1695. These new authenticator data flags will help RP's understand when a user registers an authenticator that is capable of backing up its credentials, and whether or not a particular eligible credential has been backed up.
Now, both
verifyRegistrationResponse()andverifyAuthenticationResponse()will return the following new values inregistrationInfoandauthenticationInforespectively:credentialDeviceType: "singleDevice" | "multiDevice"indicating whether the credential might be usable from other authenticatorscredentialBackedUp: boolindicating whether or not the credential has been backed upThese methods will also now fail when an authenticator returns the invalid combination
credentialDeviceType: "singleDevice", credentialBackedUp: truebecause they indicate a misbehaving authenticator.RPs should start persisting these values to the database for later reference to take action accordingly. Best practices of what to do when changes to
credentialBackedUpare detected are still TBD pending formal adoption of the new flags and community discussion. See the PR linked above for a preview of such discussion. At this moment in time, though, RP's can likely start enforcing that an authenticator never returns a different value forcredentialDeviceTypeafter registration.