SimpleWebAuthn

Packages:

• @simplewebauthn/[email protected]

Changes:

• [server] Third-party package security update

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [server] Add support for attestations and assertions containing RSA public keys.
• [browser] Version sync.
• [typescript-types] Version sync.

Breaking Changes

• [server] authenticatorInfo.base64PublicKey returned by verifyAttestationResponse() is now the entire public key buffer instead of a pared down form of it (it's still returned base64url-encoded). This helps ensure support for existing public keys, as well as future public key formats that may be introduced in the future. Public keys previously returned by this method must be upgraded via this "upgrader" script to work with future assertions.
• [server] The serviceName argument for generateAttestationOptions() has been renamed to rpName. This brings it in line with the existing rpID argument and maps more obviously to its respective property within the returned options.

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [server] Return explicit defaults for authenticatorSelection in return value from generateAttestationOptions() for enhanced device compatibility.
• [browser] Version sync.
• [typescript-types] Version sync.

Packages:

• @simplewebauthn/[email protected]

Changes:

• [server] Stop filtering out algorithm ID's from supportedAlgorithmIDs when calling generateAttestationOptions()
• [server] Fix a bug when verifying TPM attestation extensions

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [server] The challenge parameter of generateAttestationOptions() and generateAssertionOptions() is now optional.
  • When undefined the library will generate a random challenge. This value will be base64url-encoded in preparation for transit to the front end.
  • When defined the value will be directly encoded to base64url in preparation for transit to the front end.
• [browser] startAttestation() and startAssertion() now convert the base64url-encoded options.challenge to a buffer before passing it to the authenticator.

Breaking Changes

• [server] verifyAttestationResponse() and verifyAssertionResponse() now require the base64url-encoded challenge to be passed in as expectedChallenge:

Before:

const challenge = 'someChallenge';

const opts = generateAttestationOptions({
  ...atteOpts,
  challenge,
});

const verification = verifyAttestationResponse({
  ...atteResp,
  // Raw original value
  expectedChallenge: challenge,
});

After:

const challenge = 'someChallenge';

const opts = generateAttestationOptions({
  ...atteOpts,
  // This is now optional
  challenge,
});

const verification = verifyAttestationResponse({
  ...atteResp,
  // Now expected to be the base64url-encoded `challenge` returned
  // by `generateAttestationOptions()`
  expectedChallenge: opts.challenge,
});

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [browser] Update dependencies
• [server] Update dependencies

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [browser] Add support for UTF-8 values in server challenges
• [server] Minor performance improvement

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [server] Added support for specifying a custom array of COSE algorithm identifiers when calling generateAttestationOptions() and verifyAttestationResponse()
• [browser] Updated README.md with new doc URLs

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• Fixed broken README and Homepage links in package listings on NPMJS.com

Packages:

• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]
• @simplewebauthn/[email protected]

Changes:

• [server] Add support for TPM attestations
• [server] Add support for Android Key attestations
• [server] Add support for authenticator metadata statements and the FIDO Metadata Service (MDS)

Breaking Changes

• [server] The return type of verifyAttestationResponse() changed from boolean to Promise<boolean>. This was necessary to support querying FIDO MDS for an authenticator metadata statement during attestation verification.
• [server] The optional requireUserVerification parameter of verifyAssertionResponse() has been replaced with the new optional fidoUserVerification parameter. This enables greater control over user verification when verifying assertions.

• [typescript-types] Update verifyAttestationResponse() options param description.

• [server] (BREAKING) Server's verifyAttestationResponse() and verifyAssertionResponse() methods now take a single arguments object.
• [server] These methods now include the ability to require user verification during attestation and assertion verification via the new requireUserVerification argument.

• [browser] (BREAKING) Refactor startAttestation() and startAssertion() to return more of the output from the navigator.credentials calls
• [browser] Replace base64-js dependency with internal functionality
• [browser, server] Standardize on use of Base64URL encoding when converting to and from JSON
• [server] (BREAKING) Remove references to "base64" from generateAttestationOptions() and generateAssertionOptions() by renaming the excludedBase64CredentialIDs and allowedBase64CredentialIDs to excludedCredentialIDs and allowedCredentialIDs respectively
• [typescript-types] (BREAKING) Migrate some non-shared typings into server

• [typescript-types] Re-export AuthenticatorAttestationResponseJSON and AuthenticatorAssertionResponseJSON