Skip to content

fix(webauthn): advertise every algorithm the FIDO specification requires - #203

Merged
Bccorb merged 1 commit into
mainfrom
fix/webauthn-advertise-rs1
Aug 29, 2026
Merged

fix(webauthn): advertise every algorithm the FIDO specification requires#203
Bccorb merged 1 commit into
mainfrom
fix/webauthn-advertise-rs1

Conversation

@Bccorb

@Bccorb Bccorb commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Closes #166. No cross-repo work, no release round trip.

The gap

generateRegistrationOptions never set supportedAlgorithmIDs, so the
SimpleWebAuthn default applied:

const defaultSupportedAlgorithmIDs = [-8, -7, -257];  // EdDSA, ES256, RS256

FIDO Server Requirements v2.3 requires a server to implement RS1, RS256,
ES256 and EdDSA. RS1 was missing, and a conformance run would have flagged
it.

Ordering is part of the fix, not decoration

pubKeyCredParams is an ordered preference list, so where RS1 sits matters
as much as whether it is there. RS1 is RSASSA-PKCS1-v1_5 with SHA-1:

const SUPPORTED_ALGORITHM_IDS = [
  -8,     // EdDSA
  -7,     // ES256
  -257,   // RS256
  -65535, // RS1
];

Advertised because the specification requires support for it, ordered last so no
authenticator with a better option available will choose it. Both facts are
asserted, including a separate assertion that RS1 is specifically the last entry
rather than merely present.

A second gap found while fixing the first

verifyRegistrationResponse takes the same option, and its default is every
algorithm the library knows
. So the server was accepting credentials using
algorithms it never advertised. Verification is now pinned to the same constant,
so what is offered and what is accepted cannot drift apart.

Why state the set at all

Leaving it to a library default means a minor upgrade can silently change what
this server advertises. That is how RS1 came to be missing in the first place.
The test pins the exact array, so the next upgrade that changes it fails loudly.

Mutation checked

Removing RS1 from the constant fails exactly the two new tests and nothing else,
so they are real guards rather than assertions that happen to pass.

Verification

92 test files, 1012 passed, 1 skipped. Coverage 98.78% lines. typecheck,
lint, format:check clean. Contract regenerated, no change to it: the
algorithm set is inside the generated credential options rather than in the
documented schema.

Registration took the SimpleWebAuthn default of [-8, -7, -257], which omits RS1.
FIDO Server Requirements v2.3 requires RS1, RS256, ES256 and EdDSA, so a
conformance run would have flagged it.

The set is now explicit and ordered by preference. pubKeyCredParams is an
ordered list, and RS1 is RSASSA-PKCS1-v1_5 with SHA-1, so it sits last: offered
because the specification requires support for it, ordered so nothing picks it
while a better option is available.

Verification is pinned to the same set. It previously defaulted to every
algorithm the library knows, which accepted credentials using algorithms this
server never advertised.

Closes #166
@Bccorb
Bccorb merged commit 606b1a4 into main Aug 29, 2026
4 checks passed
@Bccorb
Bccorb deleted the fix/webauthn-advertise-rs1 branch August 29, 2026 04:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Registration does not advertise RS1, which FIDO Server Requirements v2.3 requires

1 participant