W3C home > Mailing lists > Public > public-webauthn@w3.org > March 2017

[webauthn] Consider empty allowLists

From: Jeffrey Yasskin via GitHub <sysbot+gh@w3.org>
Date: Wed, 22 Mar 2017 19:01:35 +0000
To: public-webauthn@w3.org
Message-ID: <issues.opened-216174778-1490209294-sysbot+gh@w3.org>
jyasskin has just created a new issue for https://github.com/w3c/webauthn:

== Consider empty allowLists ==
https://w3c.github.io/webauthn/#getAssertion currently says:

> 11. For each authenticator currently available on this platform, perform the following steps:
>     1. Let *credentialList* be a new list.
>     1. If `options.allowList` is not empty, execute a platform-specific procedure to determine which, if any, credentials in `options.allowList` are present on this authenticator by matching with `options.allowList.id` and `options.allowList.type`, and set *credentialList* to this filtered list.
>     1. If *credentialList* is empty then continue.

If `allowList` is empty, `credentialList` remains empty, and every authenticator is skipped, which makes the call less than useful. However, not all examples include an `allowList` (e.g. https://w3c.github.io/webauthn/#sample-extensions), and the [`AssertionOptions`](https://w3c.github.io/webauthn/#dictdef-assertionoptions) definition defaults it to the empty list instead of making it required. #378 also wants to remove the technical need to pass an ID through the `allowList` for every `getAssertion()` call.

I think the spec should either consistently avoid empty `allowList`s or make them work, but I don't have an opinion which.

Please view or discuss this issue at https://github.com/w3c/webauthn/issues/387 using your GitHub account
Received on Wednesday, 22 March 2017 19:01:42 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 5 July 2022 07:26:25 UTC