Skip to content

v0.2.1

Choose a tag to compare

View all tags
@gblach gblach released this 30 Jun 20:30
· 44 commits to main since this release
v0.2.1
97a0e26
  • Attestation statement verification - verifies the attStmt for packed, tpm, android-key, and fido-u2f formats during registration.
  • Optional user_handle support for usernameless login flows
  • Reject client data with crossOrigin: true, blocking cross-origin iframe flows
  • Verify the client-supplied credential ID against authData and store the attested one as source of truth
  • Validate COSE key kty/crv during signature verification, rejecting type/curve mismatches
  • Store only the COSE key in StoredPasskey.public_key, excluding trailing extension bytes
  • Store the authenticator's real registration-time signCount instead of hardcoding 0
Assets 2
Loading