webauthn

webauthn copied to clipboard

Clearly define the way how RP handles the extensions

7

WebAuthn defines the list of the extensions. Some of extensions are client extensions and some are authenticator extensions. In the viewpoint of RP, RP may set list of extensions during...

Kieun

Regarding the issue of Credential ID exposure(13.5.6), from what perspective should RP compare RK and NRK and which should be adopted?

5

Thank you for the other day which I have received a quick response to the #1475 Issue. Let me raise another discussion in this regard. I think there are various...

keikoit

Update name, displayname and icon for RP and user

8

Depending on the scenarios or cases, RP or user may change their displayable contents like name, displayname or even icon. Since such information is supplied during the registration and used...

Kieun

Possibility to filter diplayed authenticators by certified level

3

## Description Dear webAuthn community, I would like to submit this use case: Possibility to filter diplayed authenticators by certified level The rationale is the following: As several [FIDO security...

JeanDim

Use credential record abstraction in devicePubKey extension

1

This applies the new abstraction from #1773 and #1807 to the `devicePubKey` extension, which can substantially streamline the RP processing steps for the new extension. *** Preview | Diff

emlun

Give flag items in credential record more descriptive names

1

Fixes #1811. See also: https://github.com/w3c/webauthn/pull/1807#pullrequestreview-1130566110. *** Preview | Diff

emlun

Fixes #1689. *** Preview | Diff

emlun

Extracted from https://github.com/w3c/webauthn/pull/1807#pullrequestreview-1130566110 : Currently the [Credential Record](https://w3c.github.io/webauthn/#credential-record) struct has two items `BE` and `BS`. These should have more descriptive names, like `backupEligible` and `backupStatus`. Similarly, PR #1774 should rename...

emlun

Allow for credential creation in a cross-origin iframe

2

See https://github.com/w3c/webauthn/issues/1656 This PR adds the ability to call navigator.credentials.create() in a cross-origin iframe (more exactly, a frame that is not same-origin with its ancestor chain), as long as the...

stephenmcgruer

Requirements for security of MDC, DPK and attestation

10

For high assurance services, RPs can accept the minimum requirements that are either 1. (MDC with no attestation) + (DPK with attestation), or 2. (MDC with attestation) + (DPK with...

keikoit