Web IDL support 1/N: GA, MC basic parsing by AlfioEmanueleFresta · Pull Request #138 · linux-credentials/libwebauthn

AlfioEmanueleFresta · 2025-07-27T20:23:29Z

No description provided.

AlfioEmanueleFresta · 2025-08-15T10:57:07Z

This now covers both MC and GA requests, but not responses. I'll probably tidy this up and keep responses for a separate PR.

Note to self, the failures are due to Base64UrlString being used in CTAP models, which are serialized as a Base64 string rather than URL with serde_cbor. The next step is to separate these models into two, a WebAuthn JSON model using Base64UrlString, and an equivalent CTAP model using ByteBuf. Must also review all usages of Base64UrlString.

AlfioEmanueleFresta · 2025-09-07T21:48:58Z

Marking this as ready for review as this is getting large, keeping track of further work in #134.

Copilot

Pull Request Overview

This PR introduces the foundation for Web IDL support by implementing basic parsing for GetAssertion (GA) and MakeCredential (MC) operations. The changes enable the library to parse WebAuthn operations from JSON format, which is a key requirement for Web IDL compliance.

Introduces a new IDL module with JSON parsing capabilities for WebAuthn operations
Refactors extension handling to use proper typed structures instead of enums
Adds support for parsing WebAuthn requests from JSON format with proper validation

Reviewed Changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
libwebauthn/src/ops/webauthn/mod.rs	Adds IDL module exports and updates core WebAuthn type definitions
libwebauthn/src/ops/webauthn/idl/*	New IDL parsing infrastructure with JSON deserialization support
libwebauthn/src/ops/webauthn/make_credential.rs	Refactors extension handling and adds JSON parsing support
libwebauthn/src/ops/webauthn/get_assertion.rs	Updates extension structures and adds JSON parsing capabilities
libwebauthn/src/proto/ctap2/model/*	Updates extension handling to work with new typed structures
libwebauthn/src/tests/basic_ctap2.rs	Updates test to use new extension format
Examples and other files	Updates to use new extension APIs

Comments suppressed due to low confidence (1)

libwebauthn/src/proto/ctap2/model/make_credential.rs:1

The Default trait was removed from Ctap2GetAssertionRequestExtensions but line 142 in the same file still calls skip_serializing_extensions which expects a default value check. This could cause compilation issues.

use super::{

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/rpid.rs

+impl Into<String> for RelyingPartyId {
+    fn into(self) -> String {
+        self.0


Consider implementing From<RelyingPartyId> for String instead of Into<String> for RelyingPartyId. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<String> for RelyingPartyId {

fn into(self) -> String {

self.0

impl From<RelyingPartyId> for String {

fn from(rpid: RelyingPartyId) -> String {

rpid.0

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/get.rs

+impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {
+    fn into(self) -> Ctap2PublicKeyCredentialDescriptor {
+        Ctap2PublicKeyCredentialDescriptor {
+            r#type: self.r#type,
+            id: ByteBuf::from(self.id),
+            transports: self.transports,


Consider implementing From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor instead of Into. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {

fn into(self) -> Ctap2PublicKeyCredentialDescriptor {

Ctap2PublicKeyCredentialDescriptor {

r#type: self.r#type,

id: ByteBuf::from(self.id),

transports: self.transports,

impl From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor {

fn from(value: PublicKeyCredentialDescriptorJSON) -> Self {

Ctap2PublicKeyCredentialDescriptor {

r#type: value.r#type,

id: ByteBuf::from(value.id),

transports: value.transports,

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/base64url.rs

+impl Into<Vec<u8>> for Base64UrlString {
+    fn into(self) -> Vec<u8> {
+        self.0


Consider implementing From<Base64UrlString> for Vec<u8> instead of Into<Vec<u8>>. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Vec<u8>> for Base64UrlString {

fn into(self) -> Vec<u8> {

self.0

impl From<Base64UrlString> for Vec<u8> {

fn from(b64: Base64UrlString) -> Vec<u8> {

b64.0

msirringhaus

Looking good overall, I think. I haven't had time for a full deep dive, though. I only have some preliminary questions.

libwebauthn/examples/prf_test.rs

libwebauthn/examples/webauthn_prf_hid.rs

msirringhaus · 2025-09-08T12:45:41Z

libwebauthn/src/ops/webauthn/make_credential.rs

-                        (signed_extensions.hmac_secret, None)
-                    }
-                    MakeCredentialHmacOrPrfInput::Prf => (
+                if let Some(_hmac_create_secret) = incoming_ext.hmac_create_secret {


Using if {} else if {} here means you can either have HMAC or PRF, and if you request both, HMAC will override PRF. Is that intended?

Hmm, I think you're right. Whilst I wouldn't expect a browser to request this, I'll change it so that if your makeCredential includes both HMAC & PRF, you will get both responses back.

msirringhaus · 2025-09-08T12:49:52Z

libwebauthn/src/ops/webauthn/make_credential.rs


 use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);


Should we use the defintion from libwebauthn/src/ops/webauthn/timeout.rs here? (Same in the other files where this is defined again)

msirringhaus · 2025-09-08T13:24:06Z

libwebauthn/src/ops/webauthn/get_assertion.rs

    pub hash: Vec<u8>,
    pub allow: Vec<Ctap2PublicKeyCredentialDescriptor>,
-    pub extensions: Option<GetAssertionRequestExtensions>,
+    pub extensions: GetAssertionRequestExtensions,


I confess, I'm currently a bit lost in the details of this huge PR, but if I recall correctly, we used to use the Option<> here to decide if we have to include an extensions-map in the output. Some portals like demo.yubico.com are rather strict on what they expect, e.g. if they request extensions, they expect extensions in the response, even if the map is empty. And they do not want to see that empty map, if they didn't request one.
Is this still possible with this change?

Thanks for spotting this, addressing it so we can represent both states. Also adding a test for both cases (extensions: {} and no etensions).

libwebauthn/src/ops/webauthn/get_assertion.rs

Copilot

Pull request overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-26T21:02:53Z

libwebauthn/src/ops/webauthn/make_credential.rs

+        let resident_key = if inner
+            .authenticator_selection
+            .as_ref()
+            .and_then(|s| Some(s.require_resident_key))


The .and_then(|s| Some(s.require_resident_key)) is incorrect. Using and_then with a closure that always returns Some is redundant - this should be .map(|s| s.require_resident_key) instead.

Suggested change

.and_then(|s| Some(s.require_resident_key))

.map(|s| s.require_resident_key)

Copilot · 2025-12-26T21:02:53Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+        let hmac_or_prf = match inner.extensions.clone() {
+            Some(ext) => {
+                if let Some(prf) = ext.prf {
+                    let prf_input = PrfInput::try_from(prf)?;
+                    Some(GetAssertionHmacOrPrfInput::Prf(prf_input))
+                } else if let Some(hmac) = ext.hamc_get_secret {
+                    let hmac_input = HMACGetSecretInput::try_from(hmac)?;
+                    Some(GetAssertionHmacOrPrfInput::HmacGetSecret(hmac_input))
+                } else {
+                    None
+                }
+            }
+            None => None,
+        };


The .clone() on line 84 followed by accessing .as_ref() on line 102 is inefficient. The extensions should only be accessed once (using .as_ref()) and then the necessary fields cloned individually if needed.

Copilot · 2025-12-26T21:02:54Z

libwebauthn/examples/webauthn_json_hid.rs

+        let mut channel = device.channel().await?;
+        channel.wink(TIMEOUT).await?;
+
+        // Relying


The comment "// Relying" on line 79 appears to be incomplete. It should probably say "// Relying Party ID" or similar.

Suggested change

// Relying

// Relying Party ID

libwebauthn/src/ops/webauthn/idl/get.rs

libwebauthn/src/ops/webauthn/client_data.rs

Copilot · 2025-12-26T21:02:55Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+                if let Some(prf) = ext.prf {
+                    let prf_input = PrfInput::try_from(prf)?;
+                    Some(GetAssertionHmacOrPrfInput::Prf(prf_input))
+                } else if let Some(hmac) = ext.hamc_get_secret {


The field name hamc_get_secret should be hmac_get_secret (typo is propagated from the struct definition). This will cause the extension to be silently ignored rather than parsed, which is a critical bug.

Suggested change

} else if let Some(hmac) = ext.hamc_get_secret {

} else if let Some(hmac) = ext.hmac_get_secret {

Copilot · 2025-12-26T21:02:55Z

libwebauthn/src/ops/webauthn/idl/get.rs

+    #[serde(rename = "largeBlobKey")]
+    pub large_blob: Option<LargeBlobInputJson>,
+    #[serde(rename = "hmacCreateSecret")]
+    pub hamc_get_secret: Option<HmacGetSecretInputJson>,


Typo in the field name: "hamc_get_secret" should be "hmac_get_secret" (missing the 'a' in 'hmac').

Suggested change

pub hamc_get_secret: Option<HmacGetSecretInputJson>,

pub hmac_get_secret: Option<HmacGetSecretInputJson>,

msirringhaus

Looking good so far as I can tell. A few nitpicks below.

libwebauthn/examples/webauthn_prf_hid.rs

libwebauthn/src/ops/webauthn/get_assertion.rs

libwebauthn/src/ops/webauthn/idl/create.rs

libwebauthn/src/ops/webauthn/make_credential.rs

libwebauthn/src/ops/webauthn/mod.rs

libwebauthn/src/ops/webauthn/make_credential.rs

iinuwa

This is getting pretty big. I think there are some good improvements here, and I think it'd be good to start using this to shake out the bugs.

If the easily fixable comments can be addressed, the rest can be addressed in a follow up PR to keep this moving. (e.g., my comments about PRF can be fixed in a subsequent PR.)

libwebauthn/src/ops/webauthn/client_data.rs

libwebauthn/src/ops/webauthn/get_assertion.rs

iinuwa · 2026-01-18T05:20:24Z

libwebauthn/src/ops/webauthn/idl/base64url.rs

+impl Into<Vec<u8>> for Base64UrlString {
+    fn into(self) -> Vec<u8> {
+        self.0


iinuwa · 2026-01-18T05:21:46Z

libwebauthn/src/ops/webauthn/idl/get.rs

+impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {
+    fn into(self) -> Ctap2PublicKeyCredentialDescriptor {
+        Ctap2PublicKeyCredentialDescriptor {
+            r#type: self.r#type,
+            id: ByteBuf::from(self.id),
+            transports: self.transports,


iinuwa · 2026-01-18T05:22:27Z

libwebauthn/src/ops/webauthn/idl/rpid.rs

+impl Into<String> for RelyingPartyId {
+    fn into(self) -> String {
+        self.0


libwebauthn/src/ops/webauthn/get_assertion.rs

libwebauthn/src/ops/webauthn/make_credential.rs

- Rename 'uv_requirement' to 'user_verification' to match WebAuthn IDL - Add Default derive for UserVerificationRequirement (required by serde) - Update references in get_assertion.rs

AlfioEmanueleFresta · 2026-01-24T22:06:23Z

Thank you both. Addressed all comments in your last review.

Also opened #166 for @iinuwa's comment as the change is larger. As per discussion on #linux-credentials:matrix.org:

@iinuwa you asked me to remove HMAC create from WebAuthn. I am of two minds on this:

On one side, the WebAuthn spec allows for ‘naive’ clients that passtrough unsupported extensions by converting JSON to CBOR for CTAP. This would maximise compatibility, and it was my original plan (with issue #81 for implementing passthrough behaviour and best-effort JSON -> CBOR conversion). In this case, HMAC would be passed through as an unsupported WebAuthn extension.

On the other hand, the above may cause broken behaviour for future extension that require client processing. It also is not recommended by the spec (I think it breaks a single ‘SHOULD’, altough it’s honestly a bit ambigous). It’s also a lote more work.

I’ll implement your recommendation and drop HMAC from WebAuthn (will publish this as a separate PR for ease of review). This sounds better than having partial passthrough support (HMAC only) and I don’t think I can prioritise full passthrough, nor at this stage do I think we should do so.

msirringhaus

lgtm

iinuwa

Looks good!

AlfioEmanueleFresta requested a review from msirringhaus July 27, 2025 20:23

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support (make credentials);~~ [WIP] Web IDL support Jul 27, 2025

AlfioEmanueleFresta requested a review from iinuwa July 27, 2025 20:23

AlfioEmanueleFresta force-pushed the json branch from efa24cd to c117995 Compare August 24, 2025 15:15

AlfioEmanueleFresta force-pushed the json branch from 6823563 to fbd5fb8 Compare September 7, 2025 20:45

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support~~ Web IDL support 1/N: Get assertion and make credentials basic parsing Sep 7, 2025

AlfioEmanueleFresta changed the title ~~Web IDL support 1/N: Get assertion and make credentials basic parsing~~ Web IDL support 1/N: GA, MC basic parsing Sep 7, 2025

AlfioEmanueleFresta marked this pull request as ready for review September 7, 2025 21:49

AlfioEmanueleFresta requested a review from Copilot September 8, 2025 06:36

Copilot AI reviewed Sep 8, 2025

View reviewed changes

msirringhaus reviewed Sep 8, 2025

View reviewed changes

AlfioEmanueleFresta mentioned this pull request Dec 19, 2025

Web IDL support 3/N: response JSON serialization #155

Draft

AlfioEmanueleFresta added 14 commits December 26, 2025 20:14

[WIP] Web IDL support (make credentials); next: extension parsing

1014412

[WIP] More progress

b86385d

Make Credential parsing seems working; added example

4e3ee42

Clean up warnings

80ba702

GetAssertion IDL implementation

c094136

Change back CTAP2 credential model to ByteBuf

560cf98

Fixes and test for MC

56f3436

Minor fix to test

e12fe3f

Rebase: Fix use of HmacOrPrf::None variant

294eed6

Adds basic parsing tests

fa44ab8

Add tests for get assertion

9fc6f61

Update example to use JSON

e948e2c

Address PR comments (AI assisted)

437c6af

Rebased

39cca52

AlfioEmanueleFresta force-pushed the json branch from fbb40b2 to 39cca52 Compare December 26, 2025 20:31

AlfioEmanueleFresta requested a review from Copilot December 26, 2025 20:58

Copilot started reviewing on behalf of AlfioEmanueleFresta December 26, 2025 20:59 View session

Copilot AI reviewed Dec 26, 2025

View reviewed changes

AlfioEmanueleFresta requested a review from msirringhaus January 8, 2026 21:39

msirringhaus requested changes Jan 9, 2026

View reviewed changes

iinuwa requested changes Jan 18, 2026

View reviewed changes

linux-credentials deleted a comment from Copilot AI Jan 24, 2026

AlfioEmanueleFresta added 8 commits January 24, 2026 15:42

Fix: hmac_get_secret typo

7933f7c

Feedback: From rather than Into

acf8b7b

Feedback: use rename_all=camelCase

509a22f

Feedback: Other minor fixes

93f6b3b

Feedback: Other minor fixex, simplfiied parsing chain

f39c9ca

Feedback: More rename_all

3da4043

Feedback: Fix UV field naming for JSON IDL conformance

69794ff

- Rename 'uv_requirement' to 'user_verification' to match WebAuthn IDL - Add Default derive for UserVerificationRequirement (required by serde) - Update references in get_assertion.rs

Feedback: Fix build.

9c51e1a

AlfioEmanueleFresta requested review from iinuwa and msirringhaus January 24, 2026 22:06

AlfioEmanueleFresta mentioned this pull request Jan 24, 2026

Web IDL support 2/N: drop HMAC from WebAuthn ops #166

Merged

msirringhaus approved these changes Jan 26, 2026

View reviewed changes

Merge main into json

66fefe5

iinuwa approved these changes Jan 26, 2026

View reviewed changes

Pin nfc1 package to 0.6.0

8b08c6c

iinuwa merged commit 132195b into master Jan 26, 2026
4 checks passed

iinuwa deleted the json branch January 26, 2026 21:46


		use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

		pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);

	.and_then(\|s\| Some(s.require_resident_key))
	.map(\|s\| s.require_resident_key)

	} else if let Some(hmac) = ext.hamc_get_secret {
	} else if let Some(hmac) = ext.hmac_get_secret {

	pub hamc_get_secret: Option<HmacGetSecretInputJson>,
	pub hmac_get_secret: Option<HmacGetSecretInputJson>,

Conversation

AlfioEmanueleFresta commented Jul 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Sep 7, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msirringhaus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlfioEmanueleFresta Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Jul 27, 2025 •

edited

Loading

AlfioEmanueleFresta commented Aug 15, 2025 •

edited

Loading

AlfioEmanueleFresta Dec 18, 2025 •

edited

Loading

AlfioEmanueleFresta commented Jan 24, 2026 •

edited

Loading