Re: [webauthn] Should clients enforce challenge length? (#1115)

This might relevant for this issue:
Both Chrome and Firefox currently fulfill the promise if you use an empty ArrayBuffer for options.publicKey.challenge . The subtest at
https://github.com/web-platform-tests/wpt/blob/692ce5ae58a420893bd318e74b7e342a980b05a6/webauthn/createcredential-badargs-challenge.https.html#L20 .
As a side, I believe the test is incorrect to expect a TypeError and instead should expect a SecurityError, if any.

-- 
GitHub Notification of comment by plehegar
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1115#issuecomment-444931160 using your GitHub account

Received on Thursday, 6 December 2018 16:20:52 UTC