Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve consistency of Base64URL usage #59

Closed
Firehed opened this issue Dec 2, 2023 · 0 comments · Fixed by #61
Closed

Improve consistency of Base64URL usage #59

Firehed opened this issue Dec 2, 2023 · 0 comments · Fixed by #61
Milestone
1.0

Comments

@Firehed
Copy link
Owner

Firehed commented Dec 2, 2023

Some of the API is a little clumsy with data formats. In particular, the userHandle could be binary (depending on what was originally used during setup - for 99% of users, probably not), and the credential storage identifier on the v1 format is hex-encoded. With the Level 3 recommendations (#48), most things really want to be in B64U.

Note that if the storage id formats aren't identical across all versions (currently they are not!), there's potential for some really strange breakage. That should get rectified. It's somewhat inherently a BC break, but that's why no stable release has been tagged yet!
@Firehed Firehed mentioned this issue Dec 3, 2023
Merged
Firehed added a commit that referenced this issue Dec 3, 2023
@Firehed
Support base64url access for challenges; adjust legacy credential for…
2638034 
…mat (#61)

This reduces the need for RP servers to use internal methods by directly
exposing the challenge as base64url, which is used by the (limited
support) native formats as noted in #48 (a tool to produce the entire
format will come as well!).

Additionally, this matches up the storage id formats for both credential
formats, which as-is would not function as expected (new authorizations
would return a v2, and subsequently could fail to find an existing
matching v1 format depending on the lookup approach)

> [!WARNING]
> BC BREAK: this changes the storage identifier for the older credential
format. This was noted in tests as a pre-1.0 possibility.

Fixes #59
@Firehed Firehed added this to the 1.0 milestone Dec 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
1.0
Development

Successfully merging a pull request may close this issue.

Support base64url access for challenges; adjust legacy credential format Firehed/webauthn-php
1 participant
@Firehed