libwebauthn v0.7.0

Highlights

Features

• largeBlob extension: read, write, and delete (#206, #261)
• Persistent pinUvAuthToken for read-only credential management, the CTAP 2.2 perCredMgmtRO feature, with a caller-supplied token store and invalidation on rejection or PIN change (#231-#234)
• Enforce userVerification=required on the shared-secret path (#248)

Fixes

• base64url-decode excludeCredentials ids (#242)
• order crossOrigin before topOrigin in clientDataJSON (#241)
• scope rp.id to the registrable domain under multi-label suffixes (#240)
• emit makeCredential extensions in canonical CBOR order (#243)
• preserve raw authenticatorData, rpIDHash, and templateId (#245, #249)
• decode unsignedExtensionOutputs at GetAssertion (#244)
• full-length U2F_REGISTER response and preserved APDU status words on NFC (#246, #247)

---

What's Changed

• feat(pin): add pcmr permission and rename ephemeral token source (1/5) by @AlfioEmanueleFresta in #231
• feat(pin): add persistent token store trait and HID plumbing (2/5) by @AlfioEmanueleFresta in #232
• feat(pin): acquire and reuse persistent tokens via encIdentifier recognition (3/5) by @AlfioEmanueleFresta in #233
• feat(pin): invalidate persistent tokens on rejection and PIN change (4/5) by @AlfioEmanueleFresta in #234
• docs(credmgmt): document persistent token usage and add example (5/5) by @AlfioEmanueleFresta in #235
• fix(webauthn): scope rp.id to the registrable domain under multi-label suffixes by @AlfioEmanueleFresta in #240
• fix(webauthn): order crossOrigin before topOrigin in clientDataJSON by @AlfioEmanueleFresta in #241
• fix(ctap2): emit makeCredential extensions in canonical CBOR order by @AlfioEmanueleFresta in #243
• fix(ctap2): return raw rpIDHash and templateId from management by @AlfioEmanueleFresta in #245
• fix(ctap1): request full-length response for U2F_REGISTER by @AlfioEmanueleFresta in #246
• fix(nfc): preserve APDU status words on the U2F path by @AlfioEmanueleFresta in #247
• fix(webauthn): enforce userVerification=required on the shared-secret path by @AlfioEmanueleFresta in #248
• fix(webauthn): base64url-decode excludeCredentials ids by @AlfioEmanueleFresta in #242
• fix(ctap2): decode unsignedExtensionOutputs at GetAssertion 0x08 by @AlfioEmanueleFresta in #244
• fix(ctap2): preserve raw authenticatorData bytes by @AlfioEmanueleFresta in #249
• feat(webauthn): largeBlob read via authenticatorLargeBlobs by @AlfioEmanueleFresta in #206
• feat(webauthn): largeBlob write and delete by @AlfioEmanueleFresta in #261
• chore(release): 0.7.0 by @AlfioEmanueleFresta in #262

Full Changelog: libwebauthn-v0.6.0...libwebauthn-v0.7.0