Skip to content

Support WebAuthn credProtect extension #344

@andreydanil

Description

@andreydanil

Firefox doesn't support cred protect. It can be verified by using the https://webauthn.me/debugger with credentialProtectionPolicy = userVerificationRequired, e.g. extensions are empty ({}) and there isn't attestedExtensionData. In Chrome, the result is:

"attestedExtensionData": {
      "credProtect": 3
    }

extensions: {
  "credProps": {
    "rk": true
  }
}

Can this bugzilla issue be prioritized please? Cred Protect is the mitigation for ysa-2024-03/.

See: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html#sctn-credProtect-extension

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions