Web IDL support 1/N: GA, MC basic parsing #138

AlfioEmanueleFresta · 2025-07-27T20:23:29Z

No description provided.

AlfioEmanueleFresta · 2025-08-15T10:57:07Z

This now covers both MC and GA requests, but not responses. I'll probably tidy this up and keep responses for a separate PR.

Note to self, the failures are due to Base64UrlString being used in CTAP models, which are serialized as a Base64 string rather than URL with serde_cbor. The next step is to separate these models into two, a WebAuthn JSON model using Base64UrlString, and an equivalent CTAP model using ByteBuf. Must also review all usages of Base64UrlString.

AlfioEmanueleFresta · 2025-09-07T21:48:58Z

Marking this as ready for review as this is getting large, keeping track of further work in #134.

Copilot

Pull Request Overview

This PR introduces the foundation for Web IDL support by implementing basic parsing for GetAssertion (GA) and MakeCredential (MC) operations. The changes enable the library to parse WebAuthn operations from JSON format, which is a key requirement for Web IDL compliance.

Introduces a new IDL module with JSON parsing capabilities for WebAuthn operations
Refactors extension handling to use proper typed structures instead of enums
Adds support for parsing WebAuthn requests from JSON format with proper validation

Reviewed Changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
libwebauthn/src/ops/webauthn/mod.rs	Adds IDL module exports and updates core WebAuthn type definitions
libwebauthn/src/ops/webauthn/idl/*	New IDL parsing infrastructure with JSON deserialization support
libwebauthn/src/ops/webauthn/make_credential.rs	Refactors extension handling and adds JSON parsing support
libwebauthn/src/ops/webauthn/get_assertion.rs	Updates extension structures and adds JSON parsing capabilities
libwebauthn/src/proto/ctap2/model/*	Updates extension handling to work with new typed structures
libwebauthn/src/tests/basic_ctap2.rs	Updates test to use new extension format
Examples and other files	Updates to use new extension APIs

Comments suppressed due to low confidence (1)

libwebauthn/src/proto/ctap2/model/make_credential.rs:1

The Default trait was removed from Ctap2GetAssertionRequestExtensions but line 142 in the same file still calls skip_serializing_extensions which expects a default value check. This could cause compilation issues.

use super::{

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/rpid.rs

+impl Into<String> for RelyingPartyId {
+    fn into(self) -> String {
+        self.0


Consider implementing From<RelyingPartyId> for String instead of Into<String> for RelyingPartyId. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<String> for RelyingPartyId {

fn into(self) -> String {

self.0

impl From<RelyingPartyId> for String {

fn from(rpid: RelyingPartyId) -> String {

rpid.0

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/get.rs

+impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {
+    fn into(self) -> Ctap2PublicKeyCredentialDescriptor {
+        Ctap2PublicKeyCredentialDescriptor {
+            r#type: self.r#type,
+            id: ByteBuf::from(self.id),
+            transports: self.transports,


Consider implementing From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor instead of Into. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Ctap2PublicKeyCredentialDescriptor> for PublicKeyCredentialDescriptorJSON {

fn into(self) -> Ctap2PublicKeyCredentialDescriptor {

Ctap2PublicKeyCredentialDescriptor {

r#type: self.r#type,

id: ByteBuf::from(self.id),

transports: self.transports,

impl From<PublicKeyCredentialDescriptorJSON> for Ctap2PublicKeyCredentialDescriptor {

fn from(value: PublicKeyCredentialDescriptorJSON) -> Self {

Ctap2PublicKeyCredentialDescriptor {

r#type: value.r#type,

id: ByteBuf::from(value.id),

transports: value.transports,

Copilot · 2025-09-08T06:38:08Z

libwebauthn/src/ops/webauthn/idl/base64url.rs

+impl Into<Vec<u8>> for Base64UrlString {
+    fn into(self) -> Vec<u8> {
+        self.0


Consider implementing From<Base64UrlString> for Vec<u8> instead of Into<Vec<u8>>. The From trait automatically provides the Into implementation and is the preferred approach in Rust.

Suggested change

impl Into<Vec<u8>> for Base64UrlString {

fn into(self) -> Vec<u8> {

self.0

impl From<Base64UrlString> for Vec<u8> {

fn from(b64: Base64UrlString) -> Vec<u8> {

b64.0

Copilot · 2025-09-08T06:38:09Z

libwebauthn/src/ops/webauthn/client_data.rs

+        let json =     
+            format!("{{\"type\":\"{op_str}\",\"challenge\":\"{challenge_str}\",\"origin\":\"{origin_str}\",\"crossOrigin\":{cross_origin_str}}}");


The JSON string construction using format! is error-prone and hard to maintain. Consider using serde_json to serialize a proper struct to ensure valid JSON format.

Copilot · 2025-09-08T06:38:09Z

libwebauthn/src/ops/webauthn/make_credential.rs

+                Some(inner.exclude_credentials)
+            },
+            extensions: inner.extensions,
+            timeout: timeout,


Redundant field initialization. When the field name matches the variable name, you can use the shorthand syntax: timeout instead of timeout: timeout.

Suggested change

timeout: timeout,

timeout,

msirringhaus

Looking good overall, I think. I haven't had time for a full deep dive, though. I only have some preliminary questions.

libwebauthn/examples/prf_test.rs

libwebauthn/examples/webauthn_prf_hid.rs

msirringhaus · 2025-09-08T12:45:41Z

libwebauthn/src/ops/webauthn/make_credential.rs

-                        (signed_extensions.hmac_secret, None)
-                    }
-                    MakeCredentialHmacOrPrfInput::Prf => (
+                if let Some(_hmac_create_secret) = incoming_ext.hmac_create_secret {


Using if {} else if {} here means you can either have HMAC or PRF, and if you request both, HMAC will override PRF. Is that intended?

Hmm, I think you're right. Whilst I wouldn't expect a browser to request this, I'll change it so that if your makeCredential includes both HMAC & PRF, you will get both responses back.

msirringhaus · 2025-09-08T12:49:52Z

libwebauthn/src/ops/webauthn/make_credential.rs


 use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);


Should we use the defintion from libwebauthn/src/ops/webauthn/timeout.rs here? (Same in the other files where this is defined again)

msirringhaus · 2025-09-08T13:24:06Z

libwebauthn/src/ops/webauthn/get_assertion.rs

    pub hash: Vec<u8>,
    pub allow: Vec<Ctap2PublicKeyCredentialDescriptor>,
-    pub extensions: Option<GetAssertionRequestExtensions>,
+    pub extensions: GetAssertionRequestExtensions,


I confess, I'm currently a bit lost in the details of this huge PR, but if I recall correctly, we used to use the Option<> here to decide if we have to include an extensions-map in the output. Some portals like demo.yubico.com are rather strict on what they expect, e.g. if they request extensions, they expect extensions in the response, even if the map is empty. And they do not want to see that empty map, if they didn't request one.
Is this still possible with this change?

Thanks for spotting this, addressing it so we can represent both states. Also adding a test for both cases (extensions: {} and no etensions).

libwebauthn/src/ops/webauthn/get_assertion.rs

Copilot

Pull request overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-26T21:02:53Z

libwebauthn/src/ops/webauthn/make_credential.rs

+        let resident_key = if inner
+            .authenticator_selection
+            .as_ref()
+            .and_then(|s| Some(s.require_resident_key))


The .and_then(|s| Some(s.require_resident_key)) is incorrect. Using and_then with a closure that always returns Some is redundant - this should be .map(|s| s.require_resident_key) instead.

Suggested change

.and_then(|s| Some(s.require_resident_key))

.map(|s| s.require_resident_key)

Copilot · 2025-12-26T21:02:53Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+        let hmac_or_prf = match inner.extensions.clone() {
+            Some(ext) => {
+                if let Some(prf) = ext.prf {
+                    let prf_input = PrfInput::try_from(prf)?;
+                    Some(GetAssertionHmacOrPrfInput::Prf(prf_input))
+                } else if let Some(hmac) = ext.hamc_get_secret {
+                    let hmac_input = HMACGetSecretInput::try_from(hmac)?;
+                    Some(GetAssertionHmacOrPrfInput::HmacGetSecret(hmac_input))
+                } else {
+                    None
+                }
+            }
+            None => None,
+        };


The .clone() on line 84 followed by accessing .as_ref() on line 102 is inefficient. The extensions should only be accessed once (using .as_ref()) and then the necessary fields cloned individually if needed.

Copilot · 2025-12-26T21:02:54Z

libwebauthn/examples/webauthn_json_hid.rs

+        let mut channel = device.channel().await?;
+        channel.wink(TIMEOUT).await?;
+
+        // Relying


The comment "// Relying" on line 79 appears to be incomplete. It should probably say "// Relying Party ID" or similar.

Suggested change

// Relying

// Relying Party ID

Copilot · 2025-12-26T21:02:54Z

libwebauthn/src/ops/webauthn/idl/get.rs

+    pub id: Base64UrlString,
+    pub r#type: Ctap2PublicKeyCredentialType,
+
+    #[serde(skip_serializing_if = "Option::is_none")]


The skip_serializing_if attribute is for serialization but is applied to a field in a struct that only derives Deserialize, not Serialize. This attribute has no effect and should be removed.

Suggested change

#[serde(skip_serializing_if = "Option::is_none")]

Copilot · 2025-12-26T21:02:54Z

libwebauthn/src/ops/webauthn/client_data.rs

+        } else {
+            "false"
+        };
+        let json =     


Trailing whitespace on this line should be removed.

Suggested change

let json =

let json =

Copilot · 2025-12-26T21:02:55Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+                if let Some(prf) = ext.prf {
+                    let prf_input = PrfInput::try_from(prf)?;
+                    Some(GetAssertionHmacOrPrfInput::Prf(prf_input))
+                } else if let Some(hmac) = ext.hamc_get_secret {


The field name hamc_get_secret should be hmac_get_secret (typo is propagated from the struct definition). This will cause the extension to be silently ignored rather than parsed, which is a critical bug.

Suggested change

} else if let Some(hmac) = ext.hamc_get_secret {

} else if let Some(hmac) = ext.hmac_get_secret {

Copilot · 2025-12-26T21:02:55Z

libwebauthn/src/ops/webauthn/idl/get.rs

+    #[serde(rename = "largeBlobKey")]
+    pub large_blob: Option<LargeBlobInputJson>,
+    #[serde(rename = "hmacCreateSecret")]
+    pub hamc_get_secret: Option<HmacGetSecretInputJson>,


Typo in the field name: "hamc_get_secret" should be "hmac_get_secret" (missing the 'a' in 'hmac').

Suggested change

pub hamc_get_secret: Option<HmacGetSecretInputJson>,

pub hmac_get_secret: Option<HmacGetSecretInputJson>,

msirringhaus

Looking good so far as I can tell. A few nitpicks below.

msirringhaus · 2026-01-09T08:39:57Z

libwebauthn/examples/webauthn_prf_hid.rs

            },
        );
-        let hmac_or_prf = GetAssertionHmacOrPrfInput::Prf {
+        let hmac_or_prf: GetAssertionHmacOrPrfInput = GetAssertionHmacOrPrfInput::Prf(PrfInput {


I don't think we need the double type marker here

Suggested change

let hmac_or_prf: GetAssertionHmacOrPrfInput = GetAssertionHmacOrPrfInput::Prf(PrfInput {

let hmac_or_prf = GetAssertionHmacOrPrfInput::Prf(PrfInput {

msirringhaus · 2026-01-09T09:28:37Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+                        .transpose()
+                        .ok()
+                        .flatten()
+                        .flatten(),


Can this be done a little bit simpler? Feels like transpose + 2x flatten points to an overly complicated data structure. E.g. does the try_from() function need to be implemented for Option<GetAssertionLargeBlobExtension> instead of GetAssertionLargeBlobExtension or &GetAssertionLargeBlobExtension? Then we could maybe do and_then() instead of map() here.

msirringhaus · 2026-01-09T09:36:12Z

libwebauthn/src/ops/webauthn/get_assertion.rs

+                        },
+                    ))
+                })
+                .collect::<Result<HashMap<String, PRFValue>, GetAssertionRequestParsingError>>()?,


This can probably be shortened by omitting at least the error type

Suggested change

.collect::<Result<HashMap<String, PRFValue>, GetAssertionRequestParsingError>>()?,

.collect::<Result<HashMap<String, PRFValue>, _>>()?,

The compiler should be able to figure it out (same for String and PRFValue, but those are not overly long)

msirringhaus · 2026-01-09T09:42:42Z

libwebauthn/src/ops/webauthn/idl/create.rs

+
+#[derive(Debug, Clone, Deserialize)]
+pub struct AuthenticatorSelectionCriteria {
+    #[serde(rename = "authenticatorAttachment")]


I think you can use #[serde(rename_all = "camelCase")] here instead of renaming each field individually.

msirringhaus · 2026-01-09T09:59:50Z

libwebauthn/src/ops/webauthn/idl/create.rs

+    #[serde(default)]
+    pub require_resident_key: bool,
+    #[serde(rename = "userVerification")]
+    #[serde(default = "default_user_verification")]


We could think about deriving Default for UserVerificationRequirement and marking Preferred with #[default] and remove default_user_verification(). But maybe we don't want a default impl for that. Would be nice if serde would finally implement the ability to add default values here.

msirringhaus · 2026-01-09T10:11:04Z

libwebauthn/src/ops/webauthn/make_credential.rs

 }

-#[derive(Debug, Clone, Copy)]
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq)]


This could also be done with rename_all

msirringhaus · 2026-01-09T10:15:01Z

libwebauthn/src/ops/webauthn/make_credential.rs

 pub enum MakeCredentialLargeBlobExtension {
-    #[default]
-    None,
+    #[serde(rename = "preferred")]


rename_all

msirringhaus · 2026-01-09T10:15:09Z

libwebauthn/src/ops/webauthn/make_credential.rs

 }

-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Default, Clone, Deserialize, PartialEq)]


rename_all

msirringhaus · 2026-01-09T10:17:41Z

libwebauthn/src/ops/webauthn/mod.rs

+    GetAssertion,
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq)]


rename_all

msirringhaus · 2026-01-09T11:51:18Z

libwebauthn/src/ops/webauthn/make_credential.rs

+#[derive(Debug, Clone, Deserialize, PartialEq)]
+pub struct MakeCredentialPrfInput {
+    #[serde(rename = "eval")]
+    pub _eval: Option<JsonValue>,


Can we have a comment here, why it's _eval, aka not used at the moment?

AlfioEmanueleFresta requested a review from msirringhaus July 27, 2025 20:23

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support (make credentials);~~ [WIP] Web IDL support Jul 27, 2025

AlfioEmanueleFresta requested a review from iinuwa July 27, 2025 20:23

AlfioEmanueleFresta force-pushed the json branch from efa24cd to c117995 Compare August 24, 2025 15:15

AlfioEmanueleFresta force-pushed the json branch from 6823563 to fbd5fb8 Compare September 7, 2025 20:45

AlfioEmanueleFresta changed the title ~~[WIP] Web IDL support~~ Web IDL support 1/N: Get assertion and make credentials basic parsing Sep 7, 2025

AlfioEmanueleFresta changed the title ~~Web IDL support 1/N: Get assertion and make credentials basic parsing~~ Web IDL support 1/N: GA, MC basic parsing Sep 7, 2025

AlfioEmanueleFresta marked this pull request as ready for review September 7, 2025 21:49

AlfioEmanueleFresta requested a review from Copilot September 8, 2025 06:36

Copilot AI reviewed Sep 8, 2025

View reviewed changes

msirringhaus reviewed Sep 8, 2025

View reviewed changes

AlfioEmanueleFresta mentioned this pull request Dec 19, 2025

Web IDL support 2/N: response JSON serialization #155

Open

AlfioEmanueleFresta added 14 commits December 26, 2025 20:14

[WIP] Web IDL support (make credentials); next: extension parsing

1014412

[WIP] More progress

b86385d

Make Credential parsing seems working; added example

4e3ee42

Clean up warnings

80ba702

GetAssertion IDL implementation

c094136

Change back CTAP2 credential model to ByteBuf

560cf98

Fixes and test for MC

56f3436

Minor fix to test

e12fe3f

Rebase: Fix use of HmacOrPrf::None variant

294eed6

Adds basic parsing tests

fa44ab8

Add tests for get assertion

9fc6f61

Update example to use JSON

e948e2c

Address PR comments (AI assisted)

437c6af

Rebased

39cca52

AlfioEmanueleFresta force-pushed the json branch from fbb40b2 to 39cca52 Compare December 26, 2025 20:31

AlfioEmanueleFresta requested a review from Copilot December 26, 2025 20:58

Copilot started reviewing on behalf of AlfioEmanueleFresta December 26, 2025 20:59 View session

Copilot AI reviewed Dec 26, 2025

View reviewed changes

AlfioEmanueleFresta requested a review from msirringhaus January 8, 2026 21:39

msirringhaus requested changes Jan 9, 2026

View reviewed changes

		let json =
		format!("{{\"type\":\"{op_str}\",\"challenge\":\"{challenge_str}\",\"origin\":\"{origin_str}\",\"crossOrigin\":{cross_origin_str}}}");


		use super::{DowngradableRequest, RegisterRequest, UserVerificationRequirement};

		pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(60);

	.and_then(\|s\| Some(s.require_resident_key))
	.map(\|s\| s.require_resident_key)

	} else if let Some(hmac) = ext.hamc_get_secret {
	} else if let Some(hmac) = ext.hmac_get_secret {

	pub hamc_get_secret: Option<HmacGetSecretInputJson>,
	pub hmac_get_secret: Option<HmacGetSecretInputJson>,

	let hmac_or_prf: GetAssertionHmacOrPrfInput = GetAssertionHmacOrPrfInput::Prf(PrfInput {
	let hmac_or_prf = GetAssertionHmacOrPrfInput::Prf(PrfInput {

	.collect::<Result<HashMap<String, PRFValue>, GetAssertionRequestParsingError>>()?,
	.collect::<Result<HashMap<String, PRFValue>, _>>()?,

Web IDL support 1/N: GA, MC basic parsing #138

Are you sure you want to change the base?

Web IDL support 1/N: GA, MC basic parsing #138

Uh oh!

Conversation

AlfioEmanueleFresta commented Jul 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AlfioEmanueleFresta commented Sep 7, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 8, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlfioEmanueleFresta Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

msirringhaus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

AlfioEmanueleFresta commented Jul 27, 2025 •

edited

Loading

AlfioEmanueleFresta commented Aug 15, 2025 •

edited

Loading

AlfioEmanueleFresta Dec 18, 2025 •

edited

Loading