Re: [webauthn] Variable reference issue in DPK processing rules (#1817)

As discussed in the 14-Dec-22 working group call, it doesn't make security sense to fields from the signed authenticator extension output to the client extension output in an unsigned form.  I suggest that when the extension is supported and used, that the client extension output simply be `true` - indicating that the extension was used and the values in the authenticator extension output should be used.

-- 
GitHub Notification of comment by selfissued
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/1817#issuecomment-1353290162 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Thursday, 15 December 2022 15:41:46 UTC