-
-
Notifications
You must be signed in to change notification settings - Fork 192
Description
It's duplicating RawId, and isn't checked anywhere (in 4.0, reverse situation with RawId in 3.0.1), other than one place that validates it was present in the object. Transmitting two nearly same base64 strings feels rather wasteful, and makes it rather confusing as to why both are required when implementing the client side part in a web application or supplying needed data to create a AuthenticatorAssertionRawResponse
if the server does not directly get it as an endpoint argument.
I'm also not really sure why there's a check for Type
being public-key
, given that all the other required info can exist only on that type. But I suppose it's useful for informing the library user that they have supplied wrong data.
As a workaround it could be set to an empty string (or RawId to empty array in 3.0.1) so that it's present but doesn't need to be transmitted or reencoded to base64 from rawid at all (and you get the drill for 3.0.1).