Skip to content

Conversation

@MasterKale
Copy link
Owner

@MasterKale MasterKale commented Sep 14, 2025

This PR adds a new option to verifyRegistrationResponse() that allows RPs wishing to support the widest range of Android devices to disable the requirement that the ctsProfileMatch bit in an Android Safety Net attestation response be true. Simply put, this bit communicates whether the Android device's system integrity has been "compromised" in some way, e.g. the device has been rooted, Android has been modified, etc...

To use the new option, set attestationSafetyNetEnforceCTSCheck to false:

const verification = await verifyRegistrationResponse({
  // ...
  attestationSafetyNetEnforceCTSCheck: false,
});

Fixes #702.

@MasterKale MasterKale added the package:server @simplewebauthn/server label Sep 14, 2025
@MasterKale MasterKale added this to the v13.2.0 milestone Sep 14, 2025
@MasterKale MasterKale merged commit 373dffe into master Sep 14, 2025
4 checks passed
@MasterKale MasterKale deleted the fix/702-add-safetnet-cts-enforcement-reg-option branch September 14, 2025 23:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

package:server @simplewebauthn/server

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Android Safetynet fails due to CTS Profile mistatch

2 participants