search

Yubico / java-webauthn-server

Server-side Web Authentication library for Java https://www.w3.org/TR/webauthn/#rp-operations
Other
443 stars 139 forks source link

Add extra-data field to `RegisteredCredential` #290

Closed iaik-jheher closed 8 months ago

iaik-jheher commented 1 year ago

As discussed in #274, this proposes an opaque, type-safe extra-data field on RegisteredCredential. This field can be used by library consumers to pass arbitrary data from their credential repository back up to their business logic.

I've additionally taken the liberty of replacing the @JsonCreator constructor with Lombok's @Jacksonized on the class itself; this should be equivalent for JSON deserialization purposes (the test cases check this), but allows the Lombok @Builder annotation to generate its own private constructor.

emlun commented 8 months ago

This is now superseded by the new CredentialRecord interface used by CredentialRepositoryV2<C extends CredentialRecord>. When CredentialRepositoryV2 is used instead of CredentialRepository, the AssertionResultV2.getCredential() method returns the concrete type C set in the CredentialRepositoryV2 instance. This should allow the same and more flexibility in passing additional data up from the database layer, while also preserving types at compile time. I hope this satisfies your use case; if not, please let us know!

emlun commented 8 months ago

Ah, I should also note that these new features are available in experimental release 2.6.0-alpha4.