java-webauthn-server
java-webauthn-server copied to clipboard
SupportedCtapOptions does not signal absent (not supported) options
From the CTAP specs you should be able to tell if an authenticator does not support, say, user verification because the uv flag is absent. So there are three states, true and false, which signals the authenticator supports uv, and absent, which signals the authenticator does not support uv.
I assumed this was the same as what is represented in FIDO metadata. Some authenticators have true, some false, and for others it is absent. If that is what it means, I am not sure this is represented in the SupportedCtapOptions class, as they are all primitive booleans defaulting to false.