search

w3c / webauthn

Web Authentication: An API for accessing Public Key Credentials
https://w3c.github.io/webauthn/
Other
1.19k stars 172 forks source link

"Verify" is undefined #2208

Open annevk opened 3 days ago

annevk commented 3 days ago

For example, https://w3c.github.io/webauthn/#sctn-registering-a-new-credential has a step that reads

Verify that the value of C.type is webauthn.create.

but it's not at all clear what this means or what should happen when it cannot be true. If it's always meant to be true unless something outside of the scope of the specification has happened, it would be more appropriate to use Infra's Assert primitive.

If it can actually have other values, you'll need to define how to handle those.

dwaite commented 1 day ago

In this context, this is describing processing logic for the consumer of the API and the received messages.

A failed verify will defer to the application's error processing logic. It is a runtime security check on the message received via the API, and not a logical invariant.

I suspect an enhancement here would be to describe relying party behavior when a verification step fails across the entire section.

I will add that as a consumer of the API I did not have any confusion on this particular element of this section - but I'm on the "experienced" end of the spectrum when it comes to these sorts of systems.

nicksteele commented 1 day ago

I could see verify being changed to assert for syntactic clarity in the cases where we're talking direct equality between two values (such as steps 7,8,9, and 20) but I do think that "verify" is pretty clear in what is occurring, and it should come down to the RP to determine how they wish to process an erroneous response, as dwaite mentioned.

annevk commented 1 day ago

If you want to record an error or return from the algorithm with some kind of error you need to actually state that.