webauthn
webauthn copied to clipboard
w3c
Add examples for PRF extension
Proposed Change
Multiple people who are implementing PRF extensions have got the implementation wrong regarding extension fields in request and response.
We have to add some examples for this extension.
I've got a sample prf tester HTML doc in a gist that has seemed to survive scrutiny so far (or maybe it's the reason why people are doing prf incorrectly 😅)
https://gist.github.com/MasterKale/dbe39a01438251f0cbd55576304731fd
Anything in here we might want to borrow? That said there are plenty of footguns with prf and so if we do include examples we should include plenty of disclaimers that e.g. deleting a passkey permanently prevents access to anything protected by that passkey's corresponding PRF bytes.
From WG Meeting @ 7/17: Examples of using PRF seem more applicable as either test vectors or as externally produced documentation. Let's bucket this as something to address as part of #1633.
