Provide bypass for not-yet-supported attestation formats #71
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By default, the library will require any sort of "certain" trust path during credential registration - this is actually slightly stricter than the previous behavior, as
Packed
formats can result in this path. To compensate (and as a bonus, ease library development), this provides a new flag that can be passed to the registration verification process that permits these uncertain paths to go through.In effect, if this flag is set, any credential has the security implications of the
none
format: you really know nothing about it, but authentication still is cryptographically verified. In the common case this means nothing, since (at minimum) Apple's implementation of passkeys usesfmt: none
and blocking them is likely undesirable for most people.Fixes #69.