Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Substitute enum types in dictionaries with DOMStrings #1392

Merged
merged 13 commits into from
May 27, 2020
Merged

Substitute enum types in dictionaries with DOMStrings #1392

Changes from 9 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
64e9a98
Update PublicKeyCredentialCreationOptions
jcjones Mar 24, 2020
8fb8cef
Update PublicKeyCredentialRequestOptions
jcjones Mar 24, 2020
06080e7
Update for PublicKeyCredential/transports
jcjones Mar 24, 2020
55cb499
Update for AuthenticatorSelectionCriteria
jcjones Mar 24, 2020
ec3316e
Update for PublicKeyCredentialDescriptor
jcjones Mar 24, 2020
c4a9dd8
Update for TokenBinding
jcjones Mar 24, 2020
96837b6
Update for PublicKeyCredentialParameters
jcjones Mar 24, 2020
f17baf0
Updates per @agl's review comments
jcjones Mar 25, 2020
8b0dbbc
Use the same 'ignore unknown values' language, which is used 8 times …
jcjones Apr 17, 2020
a597959
Update ResidentKeyRequirement to be a DOMString, too.
jcjones Apr 27, 2020
ecf8b6f
Address @equalsJeffH's https://github.com/w3c/webauthn/pull/1392#issu…
jcjones Apr 30, 2020
46363c6
Merge in changes from trunk
jcjones Apr 30, 2020
42dbe07
Address @equalsJeffH - Add 2.1.1 "Enumerations as DOMString Types"
jcjones May 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 16 additions & 17 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1783,7 +1783,7 @@ a numbered step. If outdented, it (today) is rendered either as a bullet in the
:: |attestationObject|

: {{AuthenticatorAttestationResponse/[[transports]]}}
:: A sequence of zero or more unique {{DOMString}}s, in lexicographical order, that the |authenticator| is believed to support. The values SHOULD be members of {{AuthenticatorTransport}}.
:: A sequence of zero or more unique {{DOMString}}s, in lexicographical order, that the |authenticator| is believed to support. The values SHOULD be members of {{AuthenticatorTransport}}, but [=client platforms=] MUST ignore unknown values.
jcjones marked this conversation as resolved.
Show resolved Hide resolved
emlun marked this conversation as resolved.
Show resolved Hide resolved

If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that [=[RP]=] behavior may be suboptimal.

Expand Down Expand Up @@ -2299,7 +2299,7 @@ during registration.
:: This operation returns the value of {{AuthenticatorAttestationResponse/[[transports]]}}.

: <dfn>\[[transports]]</dfn>
:: This [=internal slot=] contains a sequence of zero or more unique {{DOMString}}s in lexicographical order. These values are the transports that the [=authenticator=] is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of {{AuthenticatorTransport}} but [=[RPS]=] MUST accept unknown values.
:: This [=internal slot=] contains a sequence of zero or more unique {{DOMString}}s in lexicographical order. These values are the transports that the [=authenticator=] is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of {{AuthenticatorTransport}} but [=[RPS]=] MUST ignore unknown values.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this right? Shouldn't the RP just pass all values through (known or unknown) and let the client ignore the ones it doesn't need?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But what does the RP do with an unknown value?

The authenticator says it supports USB and ZWave. Does the RP need to permit ZWave, or just ignore it?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this value isn't signed, the RP should never make permission decisions based on it, right (such decisions should be based on data derived from the attestation cert)? So I don't know what else the RP would do with this value other than echo it back to the client.

equalsJeffH marked this conversation as resolved.
Show resolved Hide resolved
</div>

### Web Authentication Assertion (interface <dfn interface>AuthenticatorAssertionResponse</dfn>) ### {#iface-authenticatorassertionresponse}
Expand Down Expand Up @@ -2339,7 +2339,7 @@ optionally evidence of [=user consent=] to a specific transaction.

<xmp class="idl">
dictionary PublicKeyCredentialParameters {
required PublicKeyCredentialType type;
required DOMString type;
emlun marked this conversation as resolved.
Show resolved Hide resolved
required COSEAlgorithmIdentifier alg;
};
</xmp>
Expand All @@ -2348,7 +2348,7 @@ optionally evidence of [=user consent=] to a specific transaction.
This dictionary is used to supply additional parameters when creating a new credential.

: <dfn>type</dfn>
:: This member specifies the type of credential to be created.
:: This member specifies the type of credential to be created. The value SHOULD be a member of {{PublicKeyCredentialType}} but [=client platforms=] MUST ignore unknown values, ignoring any {{PublicKeyCredentialParameters}} with an unknown {{PublicKeyCredentialParameters/type}}.

: <dfn>alg</dfn>
:: This member specifies the cryptographic signature algorithm with which the newly generated credential will be used, and
Expand All @@ -2371,7 +2371,7 @@ optionally evidence of [=user consent=] to a specific transaction.
unsigned long timeout;
sequence<PublicKeyCredentialDescriptor> excludeCredentials = [];
AuthenticatorSelectionCriteria authenticatorSelection;
AttestationConveyancePreference attestation = "none";
DOMString attestation = "none";
AuthenticationExtensionsClientInputs extensions;
};
</xmp>
Expand Down Expand Up @@ -2418,7 +2418,7 @@ optionally evidence of [=user consent=] to a specific transaction.

: <dfn>attestation</dfn>
:: This member is intended for use by [=[RPS]=] that wish to express their preference for [=attestation conveyance=].
The default is {{AttestationConveyancePreference/none}}.
The value SHOULD be a member of {{AttestationConveyancePreference}} but [=client platforms=] MUST ignore unknown values, treating an unknown value as if the member was unset. The default is {{AttestationConveyancePreference/none}}.
equalsJeffH marked this conversation as resolved.
Show resolved Hide resolved

: <dfn>extensions</dfn>
:: This member contains additional parameters requesting additional processing by the client and authenticator. For
Expand Down Expand Up @@ -2544,17 +2544,17 @@ attributes.

<xmp class="idl">
dictionary AuthenticatorSelectionCriteria {
AuthenticatorAttachment authenticatorAttachment;
DOMString authenticatorAttachment;
boolean requireResidentKey = false;
ResidentKeyRequirement residentKey;
jcjones marked this conversation as resolved.
Show resolved Hide resolved
UserVerificationRequirement userVerification = "preferred";
DOMString userVerification = "preferred";
};
</xmp>

<div dfn-type="dict-member" dfn-for="AuthenticatorSelectionCriteria">
: <dfn>authenticatorAttachment</dfn>
:: If this member is [=present|present=], eligible authenticators are filtered to only authenticators attached with the
specified [[#enum-attachment]].
specified [[#enum-attachment]]. The value SHOULD be a member of {{AuthenticatorAttachment}} but [=client platforms=] MUST ignore unknown values, treating an unknown value as if the member was unset.

: <dfn>requireResidentKey</dfn>
:: Note: This member is retained for backwards compatibility with WebAuthn Level 1 but is deprecated in favour of {{residentKey}}.
Expand All @@ -2574,7 +2574,7 @@ attributes.
: <dfn>userVerification</dfn>
:: This member describes the [=[RP]=]'s requirements regarding [=user verification=] for the
{{CredentialsContainer/create()}} operation. Eligible authenticators are filtered to only those capable of satisfying this
requirement.
requirement. The value SHOULD be a member of {{UserVerificationRequirement}} but [=client platforms=] MUST ignore unknown values, treating an unknown value as if the member was unset.
</div>


Expand Down Expand Up @@ -2689,7 +2689,7 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be
unsigned long timeout;
USVString rpId;
sequence<PublicKeyCredentialDescriptor> allowCredentials = [];
UserVerificationRequirement userVerification = "preferred";
DOMString userVerification = "preferred";
AuthenticationExtensionsClientInputs extensions;
};
</xmp>
Expand All @@ -2715,8 +2715,7 @@ an assertion. Its {{PublicKeyCredentialRequestOptions/challenge}} member MUST be

: <dfn>userVerification</dfn>
:: This OPTIONAL member describes the [=[RP]=]'s requirements regarding [=user verification=] for the
{{CredentialsContainer/get()}} operation. Eligible authenticators are filtered to only those capable of satisfying this
requirement.
{{CredentialsContainer/get()}} operation. The value SHOULD be a member of {{UserVerificationRequirement}} but [=client platforms=] MUST ignore unknown values, treating an unknown value as if the member was unset. Eligible authenticators are filtered to only those capable of satisfying this requirement.

: <dfn>extensions</dfn>
:: This OPTIONAL member contains additional parameters requesting additional processing by the client and authenticator.
Expand Down Expand Up @@ -2815,7 +2814,7 @@ Note: The {{CollectedClientData}} may be extended in the future. Therefore it's
};

dictionary TokenBinding {
required TokenBindingStatus status;
required DOMString status;
DOMString id;
};

Expand Down Expand Up @@ -2846,7 +2845,7 @@ Note: The {{CollectedClientData}} may be extended in the future. Therefore it's

<div dfn-type="dict-member" dfn-for="TokenBinding">
: <dfn>status</dfn>
:: This member is one of the following:
:: This member SHOULD be a member of {{TokenBindingStatus}} but [=client platforms=] MUST ignore unknown values, treating an unknown value as if the {{CollectedClientData/tokenBinding}} member was absent. When known, this member is one of the following:
agl marked this conversation as resolved.
Show resolved Hide resolved

<div dfn-type="enum-value" dfn-for="TokenBindingStatus">
: <dfn>supported</dfn>
Expand Down Expand Up @@ -2896,7 +2895,7 @@ Note: The {{CollectedClientData}} may be extended in the future. Therefore it's

<xmp class="idl">
dictionary PublicKeyCredentialDescriptor {
required PublicKeyCredentialType type;
required DOMString type;
required BufferSource id;
sequence<DOMString> transports;
};
Expand All @@ -2908,7 +2907,7 @@ parameter to the {{CredentialsContainer/create()}} or {{CredentialsContainer/get

<div dfn-type="dict-member" dfn-for="PublicKeyCredentialDescriptor">
: <dfn>type</dfn>
:: This member contains the type of the [=public key credential=] the caller is referring to.
:: This member contains the type of the [=public key credential=] the caller is referring to. The value SHOULD be a member of {{PublicKeyCredentialType}} but [=client platforms=] MUST ignore any {{PublicKeyCredentialDescriptor}} with an unknown {{PublicKeyCredentialDescriptor/type}}.

: <dfn>id</dfn>
:: This member contains the [=credential ID=] of the [=public key credential=] the caller is referring to.
Expand Down