linux-credentials / linux-credentials/libwebauthn

[Extensions] Introduce more informative enum for Extension results

Open
#79 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
579
Forks
27
Avg merge
4d 6h
Merged PRs (30d)
1

Description

From my reading of the spec, the result of client extension processing on either get() or create() could be:
1. **Accept** - Use the *client extension input* as *client extension output*. This is used for authenticator extensions that require no processing on the client, eg. [12.3. Large Blob Key (largeBlobKey): Client extension input / output / processing](https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#sctn-largeBlobKey-extension).
2. **Accept & update** - The client re-writes the authenticator extension input, with different fields, e.g. [12.5 HMAC Secret Extension (hmac-secret): Client extension processing](https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#sctn-hmac-secret-extension).
4. **Drop** - Remove this extension's payload altogether from the authenticator request, e.g. [12.1. Credential Protection (credProtect): Client extension processing](https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#credBlobFeatureDetection) drops the create() payload if credBlob size is unexpected.

```rust
enum ClientExtensionProcessingResult {
Accept(cbor::Map),
Drop,
}
```

_Originally posted by @AlfioEmanueleFresta in https://github.com/linux-credentials/libwebauthn/issues/77#issuecomment-2674105649_

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the client extension processing paths for get() and create(), then compare their current result handling with the WebAuthn extension-processing sections linked in the issue. Define how the result represents accepting input unchanged, accepting updated output, and dropping the payload; done means both paths use the more informative result consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authentication, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.