Web IDL support 1/N: GA, MC basic parsing #138

AlfioEmanueleFresta · 2025-07-27T20:23:29Z

No description provided.

AlfioEmanueleFresta · 2025-08-15T10:57:07Z

This now covers both MC and GA requests, but not responses. I'll probably tidy this up and keep responses for a separate PR.

Note to self, the failures are due to Base64UrlString being used in CTAP models, which are serialized as a Base64 string rather than URL with serde_cbor. The next step is to separate these models into two, a WebAuthn JSON model using Base64UrlString, and an equivalent CTAP model using ByteBuf. Must also review all usages of Base64UrlString.

AlfioEmanueleFresta · 2025-09-07T21:48:58Z

Marking this as ready for review as this is getting large, keeping track of further work in #134.

Copilot

Pull Request Overview

This PR introduces the foundation for Web IDL support by implementing basic parsing for GetAssertion (GA) and MakeCredential (MC) operations. The changes enable the library to parse WebAuthn operations from JSON format, which is a key requirement for Web IDL compliance.

Introduces a new IDL module with JSON parsing capabilities for WebAuthn operations
Refactors extension handling to use proper typed structures instead of enums
Adds support for parsing WebAuthn requests from JSON format with proper validation

Reviewed Changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
libwebauthn/src/ops/webauthn/mod.rs	Adds IDL module exports and updates core WebAuthn type definitions
libwebauthn/src/ops/webauthn/idl/*	New IDL parsing infrastructure with JSON deserialization support
libwebauthn/src/ops/webauthn/make_credential.rs	Refactors extension handling and adds JSON parsing support
libwebauthn/src/ops/webauthn/get_assertion.rs	Updates extension structures and adds JSON parsing capabilities
libwebauthn/src/proto/ctap2/model/*	Updates extension handling to work with new typed structures
libwebauthn/src/tests/basic_ctap2.rs	Updates test to use new extension format
Examples and other files	Updates to use new extension APIs

Comments suppressed due to low confidence (1)

libwebauthn/src/proto/ctap2/model/make_credential.rs:1

The Default trait was removed from Ctap2GetAssertionRequestExtensions but line 142 in the same file still calls skip_serializing_extensions which expects a default value check. This could cause compilation issues.

use super::{

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/rpid.rs

+impl Into<String> for RelyingPartyId {
+    fn into(self) -> String {
+        self.0


Consider implementing From<RelyingPartyId> for String instead of Into<String> for RelyingPartyId. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<String> for RelyingPartyId {

fn into(self) -> String {

self.0

impl From<RelyingPartyId> for String {

fn from(rpid: RelyingPartyId) -> String {

rpid.0

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/get.rs

+impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {
+    fn into(self) -> Ctap2PublicKeyCredentialDescriptor {
+        Ctap2PublicKeyCredentialDescriptor {
+            r#type: self.r#type,
+            id: ByteBuf::from(self.id),
+            transports: self.transports,


Consider implementing From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor instead of Into. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {

fn into(self) -> Ctap2PublicKeyCredentialDescriptor {

Ctap2PublicKeyCredentialDescriptor {

r#type: self.r#type,

id: ByteBuf::from(self.id),

transports: self.transports,

impl From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor {

fn from(value: PublicKeyCredentialDescriptorJSON) -> Self {

Ctap2PublicKeyCredentialDescriptor {

r#type: value.r#type,

id: ByteBuf::from(value.id),

transports: value.transports,

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/base64url.rs

+impl Into<Vec<u8>> for Base64UrlString {
+    fn into(self) -> Vec<u8> {
+        self.0


Consider implementing From<Base64UrlString> for Vec<u8> instead of Into<Vec<u8>>. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Vec<u8>> for Base64UrlString {

fn into(self) -> Vec<u8> {

self.0

impl From<Base64UrlString> for Vec<u8> {

fn from(b64: Base64UrlString) -> Vec<u8> {

b64.0

Copilot · 2025-09-08T06:38:09Z

libwebauthn/src/ops/webauthn/client_data.rs

+        let json =     
+            format!("{{\"type\":\"{op_str}\",\"challenge\":\"{challenge_str}\",\"origin\":\"{origin_str}\",\"crossOrigin\":{cross_origin_str}}}");


The JSON string construction using format! is error-prone and hard to maintain. Consider using serde_json to serialize a proper struct to ensure valid JSON format.

Copilot · 2025-09-08T06:38:09Z

libwebauthn/src/ops/webauthn/make_credential.rs

+                Some(inner.exclude_credentials)
+            },
+            extensions: inner.extensions,
+            timeout: timeout,


Redundant field initialization. When the field name matches the variable name, you can use the shorthand syntax: timeout instead of timeout: timeout.

Suggested change

timeout: timeout,

timeout,

msirringhaus

Looking good overall, I think. I haven't had time for a full deep dive, though. I only have some preliminary questions.

msirringhaus · 2025-09-08T12:21:07Z

libwebauthn/examples/prf_test.rs


        let eval_by_credential = HashMap::new();
-        let hmac_or_prf = GetAssertionHmacOrPrfInput::Prf {
+        let hmac_or_prf: GetAssertionHmacOrPrfInput = GetAssertionHmacOrPrfInput::Prf(PrfInput {


Is the type specifier let hmac_or_prf: GetAssertionHmacOrPrfInput needed? I think it could be removed.

msirringhaus · 2025-09-08T12:27:41Z

libwebauthn/examples/webauthn_prf_hid.rs

            },
        );
-        let hmac_or_prf = GetAssertionHmacOrPrfInput::Prf {
+        let hmac_or_prf: GetAssertionHmacOrPrfInput = GetAssertionHmacOrPrfInput::Prf(PrfInput {


Same here and below

msirringhaus · 2025-09-08T12:45:41Z

libwebauthn/src/ops/webauthn/make_credential.rs

-                        (signed_extensions.hmac_secret, None)
-                    }
-                    MakeCredentialHmacOrPrfInput::Prf => (
+                if let Some(_hmac_create_secret) = incoming_ext.hmac_create_secret {


Using if {} else if {} here means you can either have HMAC or PRF, and if you request both, HMAC will override PRF. Is that intended?

msirringhaus · 2025-09-08T12:49:52Z

libwebauthn/src/ops/webauthn/make_credential.rs


 use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);


Should we use the defintion from libwebauthn/src/ops/webauthn/timeout.rs here? (Same in the other files where this is defined again)

msirringhaus · 2025-09-08T13:24:06Z

libwebauthn/src/ops/webauthn/get_assertion.rs

    pub hash: Vec<u8>,
    pub allow: Vec<Ctap2PublicKeyCredentialDescriptor>,
-    pub extensions: Option<GetAssertionRequestExtensions>,
+    pub extensions: GetAssertionRequestExtensions,


I confess, I'm currently a bit lost in the details of this huge PR, but if I recall correctly, we used to use the Option<> here to decide if we have to include an extensions-map in the output. Some portals like demo.yubico.com are rather strict on what they expect, e.g. if they request extensions, they expect extensions in the response, even if the map is empty. And they do not want to see that empty map, if they didn't request one.
Is this still possible with this change?

msirringhaus · 2025-09-08T13:24:35Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+use super::{DowngradableRequest, RelyingPartyId, SignRequest, UserVerificationRequirement};

-#[derive(Debug, Default, Clone, Serialize)]
+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);


Same question here as elsewhere: Should this be redefined here or imported?

AlfioEmanueleFresta requested a review from msirringhaus July 27, 2025 20:23

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support (make credentials);~~ [WIP] Web IDL support Jul 27, 2025

AlfioEmanueleFresta requested a review from iinuwa July 27, 2025 20:23

AlfioEmanueleFresta force-pushed the json branch from efa24cd to c117995 Compare August 24, 2025 15:15

AlfioEmanueleFresta added 9 commits September 7, 2025 21:41

[WIP] Web IDL support (make credentials); next: extension parsing

2a47dfe

[WIP] More progress

e27a4b0

Make Credential parsing seems working; added example

386a777

Clean up warnings

3cda38e

GetAssertion IDL implementation

c455aed

Change back CTAP2 credential model to ByteBuf

7408575

Fixes and test for MC

eb3763d

Minor fix to test

cd713ab

Rebase: Fix use of HmacOrPrf::None variant

fbd5fb8

AlfioEmanueleFresta force-pushed the json branch from 6823563 to fbd5fb8 Compare September 7, 2025 20:45

AlfioEmanueleFresta added 2 commits September 7, 2025 22:10

Adds basic parsing tests

e22fb75

Add tests for get assertion

deb8c10

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support~~ Web IDL support 1/N: Get assertion and make credentials basic parsing Sep 7, 2025

AlfioEmanueleFresta changed the title ~~Web IDL support 1/N: Get assertion and make credentials basic parsing~~ Web IDL support 1/N: GA, MC basic parsing Sep 7, 2025

AlfioEmanueleFresta marked this pull request as ready for review September 7, 2025 21:49

Update example to use JSON

8aae271

AlfioEmanueleFresta requested a review from Copilot September 8, 2025 06:36

Copilot AI reviewed Sep 8, 2025

View reviewed changes

msirringhaus reviewed Sep 8, 2025

View reviewed changes

		let json =
		format!("{{\"type\":\"{op_str}\",\"challenge\":\"{challenge_str}\",\"origin\":\"{origin_str}\",\"crossOrigin\":{cross_origin_str}}}");


		use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

		pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);

Web IDL support 1/N: GA, MC basic parsing #138

Are you sure you want to change the base?

Web IDL support 1/N: GA, MC basic parsing #138

Uh oh!

Conversation

AlfioEmanueleFresta commented Jul 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Sep 7, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus left a comment

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AlfioEmanueleFresta commented Jul 27, 2025 •

edited

Loading

AlfioEmanueleFresta commented Aug 15, 2025 •

edited

Loading