What extension data is in AuthenticatorAssertionResponse.authenticatorData?

[jyasskin]

It's documented as

This attribute contains the authenticator data returned by the authenticator. See §5.1 Authenticator data.

and that section says the extension data is "a CBOR [RFC7049] map with extension identifiers as keys, and authenticator extension inputs as values". It's odd to see inputs stored in a returned structure. Should that be "client extension outputs" instead?

If it's "authenticator extension outputs", then I'm curious where the client outputs wind up.

[selfissued]

Yep - that's a bug. It should be "authenticator extension outputs". I'll file a quick PR to fix this and ask @equalsJeffH to review it and merge it. Thanks for the catch!

[equalsJeffH]

fixed by PR #421