@simplewebauthn/server | @SimpleWebAuthn

Index

Namespaces

<internal>

Type Aliases

Variables

Functions

Type Aliases

GenerateAuthenticationOptionsOpts

GenerateAuthenticationOptionsOpts: { allowCredentials?: PublicKeyCredentialDescriptorFuture[]; challenge?: string | Buffer; extensions?: AuthenticationExtensionsClientInputs; rpID?: string; timeout?: number; userVerification?: UserVerificationRequirement }

Type declaration

Optional allowCredentials?: PublicKeyCredentialDescriptorFuture[]
Optional challenge?: string | Buffer
Optional extensions?: AuthenticationExtensionsClientInputs
Optional rpID?: string
Optional timeout?: number
Optional userVerification?: UserVerificationRequirement

GenerateRegistrationOptionsOpts

GenerateRegistrationOptionsOpts: { attestationType?: AttestationConveyancePreference; authenticatorSelection?: AuthenticatorSelectionCriteria; challenge?: string | Buffer; excludeCredentials?: PublicKeyCredentialDescriptorFuture[]; extensions?: AuthenticationExtensionsClientInputs; rpID: string; rpName: string; supportedAlgorithmIDs?: COSEAlgorithmIdentifier[]; timeout?: number; userDisplayName?: string; userID: string; userName: string }

Type declaration

Optional attestationType?: AttestationConveyancePreference
Optional authenticatorSelection?: AuthenticatorSelectionCriteria
Optional challenge?: string | Buffer
Optional excludeCredentials?: PublicKeyCredentialDescriptorFuture[]
Optional extensions?: AuthenticationExtensionsClientInputs
rpID: string
rpName: string
Optional supportedAlgorithmIDs?: COSEAlgorithmIdentifier[]
Optional timeout?: number
Optional userDisplayName?: string
userID: string
userName: string

MetadataStatement

MetadataStatement: { aaguid?: string; aaid?: string; alternativeDescriptions?: AlternativeDescriptions; attachmentHint?: AttachmentHint[]; attestationCertificateKeyIdentifiers?: string[]; attestationRootCertificates: string[]; attestationTypes: Attestation[]; authenticationAlgorithms: <internal>.AlgSign[]; authenticatorGetInfo?: AuthenticatorGetInfo; authenticatorVersion: number; cryptoStrength?: number; description: string; ecdaaTrustAnchors?: EcdaaTrustAnchor[]; icon?: string; isFreshUserVerificationRequired?: boolean; isKeyRestricted?: boolean; keyProtection: KeyProtection[]; legalHeader?: string; matcherProtection: MatcherProtection[]; protocolFamily: string; publicKeyAlgAndEncodings: AlgKey[]; schema: number; supportedExtensions?: ExtensionDescriptor[]; tcDisplay: TransactionConfirmationDisplay[]; tcDisplayContentType?: string; tcDisplayPNGCharacteristics?: DisplayPNGCharacteristicsDescriptor[]; upv: Version[]; userVerificationDetails: VerificationMethodANDCombinations[] }

Type declaration

Optional aaguid?: string
Optional aaid?: string
Optional alternativeDescriptions?: AlternativeDescriptions
Optional attachmentHint?: AttachmentHint[]
Optional attestationCertificateKeyIdentifiers?: string[]
attestationRootCertificates: string[]
attestationTypes: Attestation[]
authenticationAlgorithms: <internal>.AlgSign[]
Optional authenticatorGetInfo?: AuthenticatorGetInfo
authenticatorVersion: number
Optional cryptoStrength?: number
description: string
Optional ecdaaTrustAnchors?: EcdaaTrustAnchor[]
Optional icon?: string
Optional isFreshUserVerificationRequired?: boolean
Optional isKeyRestricted?: boolean
keyProtection: KeyProtection[]
Optional legalHeader?: string
matcherProtection: MatcherProtection[]
protocolFamily: string
publicKeyAlgAndEncodings: AlgKey[]
schema: number
Optional supportedExtensions?: ExtensionDescriptor[]
tcDisplay: TransactionConfirmationDisplay[]
Optional tcDisplayContentType?: string
Optional tcDisplayPNGCharacteristics?: DisplayPNGCharacteristicsDescriptor[]
upv: Version[]
userVerificationDetails: VerificationMethodANDCombinations[]

VerifiedAuthenticationResponse

VerifiedAuthenticationResponse: { authenticationInfo: { authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs; credentialBackedUp: boolean; credentialDeviceType: CredentialDeviceType; credentialID: Buffer; newCounter: number; userVerified: boolean }; verified: boolean }

Result of authentication verification

param verified: If the authentication response could be verified
param authenticationInfo.credentialID: The ID of the authenticator used during authentication. Should be used to identify which DB authenticator entry needs its counter updated to the value below
param authenticationInfo.newCounter: The number of times the authenticator identified above reported it has been used. Should be kept in a DB for later reference to help prevent replay attacks!
param authenticationInfo.credentialDeviceType: Whether this is a single-device or multi-device credential. Should be kept in a DB for later reference!
param authenticationInfo.credentialBackedUp: Whether or not the multi-device credential has been backed up. Always false for single-device credentials. Should be kept in a DB for later reference!
param authenticationInfo?.authenticatorExtensionResults: The authenticator extensions returned by the browser

Type declaration

authenticationInfo: { authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs; credentialBackedUp: boolean; credentialDeviceType: CredentialDeviceType; credentialID: Buffer; newCounter: number; userVerified: boolean }
- Optional authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs
- credentialBackedUp: boolean
- credentialDeviceType: CredentialDeviceType
- credentialID: Buffer
- newCounter: number
- userVerified: boolean
verified: boolean

VerifiedRegistrationResponse

VerifiedRegistrationResponse: { registrationInfo?: { aaguid: string; attestationObject: Buffer; authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs; counter: number; credentialBackedUp: boolean; credentialDeviceType: CredentialDeviceType; credentialID: Buffer; credentialPublicKey: Buffer; credentialType: "public-key"; fmt: AttestationFormat; userVerified: boolean }; verified: boolean }

Result of registration verification

param verified: If the assertion response could be verified
param registrationInfo.fmt: Type of attestation
param registrationInfo.counter: The number of times the authenticator reported it has been used. Should be kept in a DB for later reference to help prevent replay attacks!
param registrationInfo.aaguid: Authenticator's Attestation GUID indicating the type of the authenticator
param registrationInfo.credentialPublicKey: The credential's public key
param registrationInfo.credentialID: The credential's credential ID for the public key above
param registrationInfo.credentialType: The type of the credential returned by the browser
param registrationInfo.userVerified: Whether the user was uniquely identified during attestation
param registrationInfo.attestationObject: The raw response.attestationObject Buffer returned by the authenticator
param registrationInfo.credentialDeviceType: Whether this is a single-device or multi-device credential. Should be kept in a DB for later reference!
param registrationInfo.credentialBackedUp: Whether or not the multi-device credential has been backed up. Always false for single-device credentials. Should be kept in a DB for later reference!
param registrationInfo?.authenticatorExtensionResults: The authenticator extensions returned by the browser

Type declaration

Optional registrationInfo?: { aaguid: string; attestationObject: Buffer; authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs; counter: number; credentialBackedUp: boolean; credentialDeviceType: CredentialDeviceType; credentialID: Buffer; credentialPublicKey: Buffer; credentialType: "public-key"; fmt: AttestationFormat; userVerified: boolean }
- aaguid: string
- attestationObject: Buffer
- Optional authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs
- counter: number
- credentialBackedUp: boolean
- credentialDeviceType: CredentialDeviceType
- credentialID: Buffer
- credentialPublicKey: Buffer
- credentialType: "public-key"
- fmt: AttestationFormat
- userVerified: boolean
verified: boolean

VerifyAuthenticationResponseOpts

VerifyAuthenticationResponseOpts: { advancedFIDOConfig?: { userVerification?: UserVerificationRequirement }; authenticator: AuthenticatorDevice; credential: AuthenticationCredentialJSON; expectedChallenge: string | ((challenge: string) => boolean); expectedOrigin: string | string[]; expectedRPID: string | string[]; requireUserVerification?: boolean }

Type declaration

Optional advancedFIDOConfig?: { userVerification?: UserVerificationRequirement }
- Optional userVerification?: UserVerificationRequirement
authenticator: AuthenticatorDevice
credential: AuthenticationCredentialJSON
expectedChallenge: string | ((challenge: string) => boolean)
expectedOrigin: string | string[]
expectedRPID: string | string[]
Optional requireUserVerification?: boolean

VerifyRegistrationResponseOpts

VerifyRegistrationResponseOpts: { credential: RegistrationCredentialJSON; expectedChallenge: string | ((challenge: string) => boolean); expectedOrigin: string | string[]; expectedRPID?: string | string[]; requireUserVerification?: boolean; supportedAlgorithmIDs?: COSEAlgorithmIdentifier[] }

Type declaration

credential: RegistrationCredentialJSON
expectedChallenge: string | ((challenge: string) => boolean)
expectedOrigin: string | string[]
Optional expectedRPID?: string | string[]
Optional requireUserVerification?: boolean
Optional supportedAlgorithmIDs?: COSEAlgorithmIdentifier[]

Variables

Const MetadataService

MetadataService: BaseMetadataService = ...

Const SettingsService

SettingsService: BaseSettingsService = ...

Functions

generateAuthenticationOptions

generateAuthenticationOptions(options?: GenerateAuthenticationOptionsOpts): PublicKeyCredentialRequestOptionsJSON

- Defined in server/src/authentication/generateAuthenticationOptions.ts:33
Prepare a value to pass into navigator.credentials.get(...) for authenticator "login"

Parameters
- options: GenerateAuthenticationOptionsOpts = {}
Returns PublicKeyCredentialRequestOptionsJSON

generateRegistrationOptions

generateRegistrationOptions(options: GenerateRegistrationOptionsOpts): PublicKeyCredentialCreationOptionsJSON

- Defined in server/src/registration/generateRegistrationOptions.ts:96
Prepare a value to pass into navigator.credentials.create(...) for authenticator "registration"

Options:

Parameters
- options: GenerateRegistrationOptionsOpts
Returns PublicKeyCredentialCreationOptionsJSON

verifyAuthenticationResponse

verifyAuthenticationResponse(options: VerifyAuthenticationResponseOpts): Promise<VerifiedAuthenticationResponse>

- Defined in server/src/authentication/verifyAuthenticationResponse.ts:48
Verify that the user has legitimately completed the login process

Options:

Parameters
- options: VerifyAuthenticationResponseOpts
Returns Promise<VerifiedAuthenticationResponse>

verifyRegistrationResponse

verifyRegistrationResponse(options: VerifyRegistrationResponseOpts): Promise<VerifiedRegistrationResponse>

- Defined in server/src/registration/verifyRegistrationResponse.ts:55
Verify that the user has legitimately completed the registration process

Options:

Parameters
- options: VerifyRegistrationResponseOpts
Returns Promise<VerifiedRegistrationResponse>

Index

Namespaces

Type Aliases

Variables

Functions

Type Aliases

GenerateAuthenticationOptionsOpts

Type declaration

Optional allowCredentials?: PublicKeyCredentialDescriptorFuture[]

Optional challenge?: string | Buffer

Optional extensions?: AuthenticationExtensionsClientInputs

Optional rpID?: string

Optional timeout?: number

Optional userVerification?: UserVerificationRequirement

GenerateRegistrationOptionsOpts

Type declaration

Optional attestationType?: AttestationConveyancePreference

Optional authenticatorSelection?: AuthenticatorSelectionCriteria

Optional challenge?: string | Buffer

Optional excludeCredentials?: PublicKeyCredentialDescriptorFuture[]

Optional extensions?: AuthenticationExtensionsClientInputs

rpID: string

rpName: string

Optional supportedAlgorithmIDs?: COSEAlgorithmIdentifier[]

Optional timeout?: number

Optional userDisplayName?: string

userID: string

userName: string

MetadataStatement

Type declaration

Optional aaguid?: string

Optional aaid?: string

Optional alternativeDescriptions?: AlternativeDescriptions

Optional attachmentHint?: AttachmentHint[]

Optional attestationCertificateKeyIdentifiers?: string[]

attestationRootCertificates: string[]

attestationTypes: Attestation[]

authenticationAlgorithms: <internal>.AlgSign[]

Optional authenticatorGetInfo?: AuthenticatorGetInfo

authenticatorVersion: number

Optional cryptoStrength?: number

description: string

Optional ecdaaTrustAnchors?: EcdaaTrustAnchor[]

Optional icon?: string

Optional isFreshUserVerificationRequired?: boolean

Optional isKeyRestricted?: boolean

keyProtection: KeyProtection[]

Optional legalHeader?: string

matcherProtection: MatcherProtection[]

protocolFamily: string

publicKeyAlgAndEncodings: AlgKey[]

schema: number

Optional supportedExtensions?: ExtensionDescriptor[]

tcDisplay: TransactionConfirmationDisplay[]

Optional tcDisplayContentType?: string

Optional tcDisplayPNGCharacteristics?: DisplayPNGCharacteristicsDescriptor[]

upv: Version[]

userVerificationDetails: VerificationMethodANDCombinations[]

VerifiedAuthenticationResponse

Type declaration

authenticationInfo: { authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs; credentialBackedUp: boolean; credentialDeviceType: CredentialDeviceType; credentialID: Buffer; newCounter: number; userVerified: boolean }

Optional authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs

credentialBackedUp: boolean

credentialDeviceType: CredentialDeviceType

credentialID: Buffer

newCounter: number

userVerified: boolean

verified: boolean

VerifiedRegistrationResponse

Type declaration

aaguid: string

attestationObject: Buffer

Optional authenticatorExtensionResults?: AuthenticationExtensionsAuthenticatorOutputs

counter: number

credentialBackedUp: boolean

credentialDeviceType: CredentialDeviceType

credentialID: Buffer

credentialPublicKey: Buffer

credentialType: "public-key"

fmt: AttestationFormat