java-webauthn-server icon indicating copy to clipboard operation
java-webauthn-server copied to clipboard

SupportedCtapOptions does not signal absent (not supported) options

Open philsmart opened this issue 1 year ago • 5 comments

From the CTAP specs you should be able to tell if an authenticator does not support, say, user verification because the uv flag is absent. So there are three states, true and false, which signals the authenticator supports uv, and absent, which signals the authenticator does not support uv.

I assumed this was the same as what is represented in FIDO metadata. Some authenticators have true, some false, and for others it is absent. If that is what it means, I am not sure this is represented in the SupportedCtapOptions class, as they are all primitive booleans defaulting to false.

philsmart avatar Sep 25 '24 12:09 philsmart