davidearl / webauthn

An implementation of webauthn in PHP on the server side (e.g Yubico 2 and Google Titan keys)
https://webauthn.davidearl.uk
MIT License
129 stars 24 forks source link

Trim unnecessary stuff #44

Open BrightSoul opened 4 years ago

BrightSoul commented 4 years ago

Hello and thanks for such a useful piece of code. Thanks to the samples I managed to implement WebAuthn in no time.

However, now I need to take it further and apply some customization. I find that all the various json_encode's and unnecessary stuff like this are impeding progress. Would you move the serialization responsibility elsewhere (or remove it altogether, since each developer will likely persist keys his/her own way) and allow options to be fed into prepareChallengeForRegistration and prepareForLogin?

Also, do you accept pull requests?

davidearl commented 4 years ago

The reason it json_encodes the auth data is so that you just get a simple string back for storage in your database whatever, so the structure of this data can be private to the webauthn library, but you can persist it in any medium you like. What would you be trying to achieve by requiring the client to manage the serialisation?

If you can maintain upward compatibility (so don't require options, and don't change the current format without a specific option being set etc.) and are adding something useful, I'd be happy to include it.

benjamindoe commented 4 years ago

@BrightSoul Would be interested to see what you come up with.

Could be a good idea to abstract what is returned out into a Contractable class or something similar. This way the default class could implemented __toString to return JSON data. It also gives the developer freedom to implement their own way of persisting keys. This should be able to maintain backward compat if done right.