webauthn

webauthn copied to clipboard

Better specify what an unknown type credential descriptor being ignored means

3

We use credential descriptors "`PublicKeyCredentialDescriptor`" for allow lists & exclude lists. The spec says > [...][client platforms](https://w3c.github.io/webauthn/#client-platform) MUST ignore any [PublicKeyCredentialDescriptor](https://w3c.github.io/webauthn/#dictdef-publickeycredentialdescriptor) with an unknown [type](https://w3c.github.io/webauthn/#dom-publickeycredentialdescriptor-type). There's no further specification for...

nsatragno

[§5.1.3. Create a New Credential](https://w3c.github.io/webauthn/#sctn-createCredential) and [§5.1.4. Use an Existing Credential to Make an Assertion](https://w3c.github.io/webauthn/#sctn-discover-from-external-source) both declare their **options** parameter as the `Credential[Creation|Request]Options` object inherited from CredMan: >**options** >This argument...

emlun

_(filing a new issue for this as it's a small change and I don't want to pile more stuff on the conditional mediation issue / pr)_ @emlun [pointed out](https://github.com/w3c/webauthn/pull/1576/files#r750426635) that...

nsatragno

Attestation on Get Assertion

3

Topic from June F2F meeting With the changing security properties of WebAuthn credentials, we need to re-evaluate the need for an RP to request attestation during a Get Assertion.

timcappalli

Several members have requested ([thread](https://lists.w3.org/Archives/Member/w3c-ac-forum/2022JanMar/thread.html#msg90)) that W3C switch its specifications to a [permissive license, the Software and Document License](https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document), for continuity planning. The WebAuthn charter (current and proposed re-charter) [states](https://www.w3.org/2019/10/webauthn-wg-charter.html#licensing)...

wseltzer

Should an RP be able to provide finer grained authenticator filtering in attestation options?

32

The use case in mind is when an RP is required to enforce attestation-based registration requirements. Why not allow the RP to suggest in attestation options a richer set of...

sbweeden

Split RP ops "Registering a new credential" into one with and one without attestation

8

Motivated by #1709. Many RPs will not need attestation, and the default `attestationConveyance` is `"none"`. It is of little use to these RPs to implement all the complexity around verifying...

emlun

RP operations: some extension processing may assume that the encompassing signature is valid

2

In both of the [RP Operations subsections](https://www.w3.org/TR/webauthn/#sctn-rp-operations) (Registering a new cred, and verifying an authn assertion), the step for verifying/processing of extension outputs is placed _before_ the step for verifying...

equalsJeffH

Update top level use cases to account for multi-device credentials

5

The current top level use cases (`sctn-use-cases`) were written prior to the multi-device credential effort and should be rewritten to include this new topic. Be sure to include: https://github.com/w3c/webauthn/issues/1735

timcappalli

Provide passwordless example, or update 1.3.2. to be a passwordless example

2

Hi, just a suggestion to help clarify the passwordless registration flow for people. [1.3.2. Registration Specifically with User-Verifying Platform Authenticator](https://w3c.github.io/webauthn/#sctn-sample-registration-with-platform-authenticator) walks through a process of registering where a user provides...

GregBrimble