Re: [webauthn] Clearly define the way how RP handles the extensions (#1258)

@emlun I'm thinking that appId, authnSel, biometricPrefBouns and credProps are the type of client extension. They don't need any other communication with authenticators. So, at least for the authenticator extension, the authenticator extension inputs should exist and be delivered to the authenticator. Also, the authenticator extension output can be conveyed within the AuthData.
My understanding is that RP needs to check the list of client extension output for client only extension and for authenticator extension, RP needs to investigate the extensions within the AuthData.

-- 
GitHub Notification of comment by Kieun
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1258#issuecomment-542125879 using your GitHub account

Received on Tuesday, 15 October 2019 09:32:50 UTC