@simplewebauthn/browser - npm Package Versions

v8.3.4

Packages

• @simplewebauthn/browser@.3.4
• @simplewebauthn/server@.3.4
• @simplewebauthn/typescript-types@.3.4

Changes

• [server] The library will now try to use globalThis.crypto first before trying to import Node's node:crypto as a fallback (#468)
• [browser, types] Version sync

v8.3.3

Packages

• @simplewebauthn/browser@8.3.3
• @simplewebauthn/server@8.3.3
• @simplewebauthn/typescript-types@8.3.3

Changes

• [server, types] deno vendor will no longer error out because typescript-types/src/dom.ts is missing (#466)
• [server] Authenticator data will now be preserved after bad CBOR encoding is detected and temporarily fixed when handling security key responses from Firefox (#465)
• [browser] Version sync due to changes in typescript-types

v8.3.1

Packages

• @simplewebauthn/browser@8.3.1

Changes

• [browser] Calling startAuthentication(..., true) to set up conditional UI will now require the "webauthn" value in an input's autocomplete="..." be either the only value or the last value (#451)

v8.3.0

Packages

• @simplewebauthn/browser@8.3.0

Changes

• [browser] The WebAuthnAbortService singleton can now be imported, with a cancelCeremony() method that can be called to manually cancel any active WebAuthn ceremonies. This can be used by developers building projects that use client-side routing to better control the behavior of their UX in response to router navigation events. (#449)

v8.2.1

Packages

• @simplewebauthn/browser@8.2.1

Changes

• [browser] startRegistration() will visibly warn in the browser console when a WebAuthn API method call errors out in a way that is likely due to a browser extension intercepting the API (#447)

v8.2.0

Packages

• @simplewebauthn/browser@8.2.0
• @simplewebauthn/server@8.2.0

Changes

• [browser] startRegistration() will no longer error out on registration responses generated by the 1Password browser extension (#443, with thanks to @unix)
• [browser] Helper methods base64URLStringToBuffer() and bufferToBase64URLString() are now exported from @simplewebauthn/browser (#444)
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() now accept a new expectedType argument that can be used to, for example, verify Secure Payment Confirmation responses (#436, with thanks to @fabiancook)
• [server] Responses containing malformed authenticator data returned from Firefox 117 will no longer raise an error (#441)

v8.0.2

Packages

• @simplewebauthn/browser@8.0.2

Changes

• [browser] The NPM package now targets ES2021 for support in older browsers like Safari 13.1 (#429)

v8.0.0 - Around the (ESM) World

This major release marks the completion of a long journey that started with the release of v7.0.0: SimpleWebAuthn is now available for use in non-Node projects! 🎉

SimpleWebAuthn debuted in mid-2020 as a combination of libraries aiming to make WebAuthn simpler to use across browsers and "NodeJS + CommonJS" applications. Since then NodeJS has evolved to gain ESM support, and additional JavaScript and TypeScript runtimes have debuted that offer ESM-centric, TypeScript-first alternatives while also implementing Web APIs to offer a more consistent and capable execution environment for developers.

I've wanted to make this project available to developers using these Node alternatives to help them get past some of WebAuthn's rough spots. Today I'm happy to announce that this goal has been achieved! 😌

See the Changes below for more information, as well as additional information on breaking changes made in this release.

Packages

• @simplewebauthn/browser@8.0.0
• @simplewebauthn/server@8.0.0
• @simplewebauthn/typescript-types@8.0.0

Changes

• [server] [typescript-types] SimpleWebAuthn can now also be used in runtimes other than Node. Deno is now a first-class runtime for this project alongside Node (#425)
  • The following list of runtimes are officially supported:
    • (Existing) NodeJS using CommonJS
    • (Existing) NodeJS using ECMAScript Modules (ESM)
    • (New) Deno @ https://deno.land/x/simplewebauthn
  • The following list of runtimes are periodically tested but unofficially supported:
    • (New) CloudFlare Workers
    • (New) Bun
• [browser] Version sync

Breaking Changes

• [server] generateRegistrationOptions() and generateAuthenticationOptions() are now asynchronous methods. Refactor calls to these methods to handle the Promise that's now returned in whatever way is appropriate for your project.
• [server] generateChallenge() (in @simplewebauthn/server/helpers) is now an asynchronous method. Refactor calls to this method to handle the Promise that's now returned in whatever way is appropriate for your project.

v7.4.0

Packages:

• @simplewebauthn/browser@7.4.0
• @simplewebauthn/iso-webcrypto@7.4.0
• @simplewebauthn/server@7.4.0
• @simplewebauthn/typescript-types@7.4.0

Changes:

• [browser] [typescript-types] AuthenticatorAttestationResponseJSON now includes additional, optional publicKeyAlgorithm, publicKey, and authenticatorData convenience values that track JSON interface changes in WebAuthn L3 draft (#400)
• [iso-crypto] Version sync
• [server] verifyRegistrationResponse() and verifyAuthenticationResponse() now return the matched origin and RP ID in their to output to help RP's that use the same verification logic with multiple origins and RP ID's understand where a response was generated and for which RP (#415)
• [typescript-types] "smart-card" is now a recognized value for AuthenticatorTransportFuture (#399)