v3.5.0

Added

• Add support for crossOrigin/topOrigin verification during credential registration and authentication by @nicolastemciuc in #486.
• Add support for the attestation_formats option in WebAuthn::Credential.options_for_create by @santiagorodriguez96 in #514.
• Add support for the hints option in WebAuthn::Credential.options_for_create and WebAuthn::Credential.options_for_get by @santiagorodriguez96 in #513.
• Reject authenticator data where the BS (backup state) flag is set but the BE (backup eligibility) flag is not, during credential registration and authentication. Raises WebAuthn::BackupFlagsVerificationError. By @santiagorodriguez96 in #516.
• Reject credential IDs longer than 1023 bytes during credential registration. Raises WebAuthn::CredentialIdLengthVerificationError. By @santiagorodriguez96 in #517.
• Add WebAuthn.generate_user_handle as an alias for generate_user_id by @ttanimichi in #503.

Changed

• Bump the default credential_options_timeout from 120_000 to 300_000 milliseconds (5 minutes) by @santiagorodriguez96 in #515.
• WebAuthn::FakeClient#get now defaults backup_state to false. The previous default (backup_eligibility: false, backup_state: true) produced authenticator data that now fails verification. By @santiagorodriguez96 in #516.
• Avoid mutating caller relying-party options by @OskarEichler in #509.

Removed

• Remove TokenBinding verification during credential registration and authentication by @nicolastemciuc in #450.
  • BREAKING CHANGE: WebAuthn::TokenBindingVerificationError no longer exists. Remove it from any rescue clauses.
  • BREAKING CHANGE: WebAuthn::FakeClient.new no longer accepts token_binding:.
  • BREAKING CHANGE: WebAuthn::ClientData no longer exposes #token_binding or #valid_token_binding_format?.

New Contributors

• @ttanimichi made their first contribution in #500
• @sandstrom made their first contribution in #505
• @OskarEichler made their first contribution in #509

Full Changelog: v3.4.3...v3.5.0