About Extensions

[Spomky]

Hi,

Excuse me for the silly question, but I am not sure how to deal with extensions.
Here is the json object returned by the Webauthn server (not a @simpleWebauthn one):

{
    "rp":{
        "name":"My Application",
        "id":"localhost"
    },
    "user":{
        "name":"john",
        "id":"MDFHRTA1VENFQjZFWFZQRzQ4WlRSMjUzWEc",
        "displayName":"John Doe"
    },
    "challenge":"ORWjIuz94d8IV6A1kbnftVmQX689C6aFu1YVACTSLys",
    "pubKeyCredParams":[],
    "timeout":60000,
    "authenticatorSelection":{
        "requireResidentKey":true,
        "userVerification":"required"
    },
    "attestation":"direct",
    "extensions":{
        "uvm":true
    }
}

The problem is that I never receive any extension output and I don't know how to make sure if I am doing something wrong or if the extension is simply ignored by the browser or the authenticator.

Any thoughts on this?
Many thanks.
Regards.

[MasterKale]

Unfortunately all you can really do is try and see if the browser returns anything. Extension support is not required in the spec and so support is very spotty. In the case of uvm, since it's a client extension if you're not getting anything back about it from navigator.credentials.create() or navigator.credentials.get() then you're kinda out of luck.

To add some anecdotal data to your quest, I've never experienced a browser that supported uvm. It's not a very popular idea in the WebAuthn working group; the opinion is that RP's that can find out what kind of user verification method was used will discriminate certain methods, when the working group wants RP's to not care about that kind of stuff. I doubt we'll ever see uvm support grow.

[MasterKale]

@Spomky I've converted your Issue into a Discussion since it's a great question, but not specifically an issue with SimpleWebAuthn. Please feel free to continue the conversation here if you want to follow up.

[Spomky]

Many thanks @MasterKale.
I understand that things are not really clear about the extensions.
My question comes from a discussion I have with @amenophis from who builds a POC to ensure a high level of trust for user verification.

[james-d-elliott]

Seems an appropriate place for this. What about the upcoming devicePubKey extension? I think this one is probably one is probably the most useful extension to date, though maybe I'm overthinking it, really hope this extension is not in the same tank as uvm. I think that passkeys are very nice but it'd also be nice to be able to require a device locked credential for security as well.

This doesn't exist yet in the typescript DOM spec probably because level 3 isn't recommended. I have no idea which browsers support it yet, I expect the values will be lost due to this when using the browser API, but I'm not great with ts/js/es. Thoughts?