@simplewebauthn/server - npm Package Compare versions

Comparing version 4.4.0 to 5.0.0

dist/authentication/verifyAuthenticationResponse.d.ts

 /// <reference types="node" />
-import { AuthenticationCredentialJSON, AuthenticatorDevice, UserVerificationRequirement } from '@simplewebauthn/typescript-types';
+import { AuthenticationCredentialJSON, AuthenticatorDevice } from '@simplewebauthn/typescript-types';
 export declare type VerifyAuthenticationResponseOpts = {
@@ -9,3 +9,3 @@ credential: AuthenticationCredentialJSON;
     authenticator: AuthenticatorDevice;
-    fidoUserVerification?: UserVerificationRequirement;
+    requireUserVerification?: boolean;
 };
@@ -23,5 +23,4 @@ /**
  * @param authenticator An internal {@link AuthenticatorDevice} matching the credential's ID
- * @param fidoUserVerification (Optional) The value specified for `userVerification` when calling
- * `generateAssertionOptions()`. Activates FIDO-specific user presence and verification checks.
- * Omitting this value defaults verification to a WebAuthn-specific user presence requirement.
+ * @param requireUserVerification (Optional) Enforce user verification by the authenticator
+ * (via PIN, fingerprint, etc...)
  */
@@ -28,0 +27,0 @@ export default function verifyAuthenticationResponse(options: VerifyAuthenticationResponseOpts): VerifiedAuthenticationResponse;

dist/authentication/verifyAuthenticationResponse.js

@@ -24,8 +24,7 @@ "use strict";
  * @param authenticator An internal {@link AuthenticatorDevice} matching the credential's ID
- * @param fidoUserVerification (Optional) The value specified for `userVerification` when calling
- * `generateAssertionOptions()`. Activates FIDO-specific user presence and verification checks.
- * Omitting this value defaults verification to a WebAuthn-specific user presence requirement.
+ * @param requireUserVerification (Optional) Enforce user verification by the authenticator
+ * (via PIN, fingerprint, etc...)
  */
 function verifyAuthenticationResponse(options) {
-    const { credential, expectedChallenge, expectedOrigin, expectedRPID, authenticator, fidoUserVerification, } = options;
+    const { credential, expectedChallenge, expectedOrigin, expectedRPID, authenticator, requireUserVerification, } = options;
     const { id, rawId, type: credentialType, response } = credential;
@@ -114,20 +113,10 @@ // Ensure credential specified an ID
     }
+    // WebAuthn only requires the user presence flag be true
+    if (!flags.up) {
+        throw new Error('User not present during authentication');
+    }
     // Enforce user verification if required
-    if (fidoUserVerification) {
-        if (fidoUserVerification === 'required') {
-            // Require `flags.uv` be true (implies `flags.up` is true)
-            if (!flags.uv) {
-                throw new Error('User verification required, but user could not be verified');
-            }
-        }
-        else if (fidoUserVerification === 'preferred' || fidoUserVerification === 'discouraged') {
-            // Ignore `flags.uv`
-        }
+    if (requireUserVerification && !flags.uv) {
+        throw new Error('User verification required, but user could not be verified');
     }
-    else {
-        // WebAuthn only requires the user presence flag be true
-        if (!flags.up) {
-            throw new Error('User not present during authentication');
-        }
-    }
     const clientDataHash = toHash_1.default(base64url_1.default.toBuffer(response.clientDataJSON));
@@ -134,0 +123,0 @@ const signatureBase = Buffer.concat([authDataBuffer, clientDataHash]);

package.json

 {
   "name": "@simplewebauthn/server",
-  "version": "4.4.0",
+  "version": "5.0.0",
   "description": "SimpleWebAuthn for Servers",
@@ -52,3 +52,3 @@ "main": "dist/index.js",
     "@peculiar/asn1-x509": "^2.0.38",
-    "@simplewebauthn/typescript-types": "^4.0.0",
+    "@simplewebauthn/typescript-types": "^5.0.0",
     "base64url": "^3.0.1",
@@ -63,3 +63,3 @@ "cbor": "^5.1.0",
   },
-  "gitHead": "4a8fb255d4fd6fbc146dedf0a2efc938b99f5973",
+  "gitHead": "7628494bedac039ce7ab9c5fad6bf153c99b2d34",
   "devDependencies": {
@@ -66,0 +66,0 @@ "@types/cbor": "^5.0.1",

No alert changes

Worsened metrics

Total package byte prevSize

242919

decreased by-0.35%

Lines of code

3790

decreased by-0.32%

Dependency changes

• + Added@simplewebauthn/typescript-types@5.4.0(transitive)

• - Removed@simplewebauthn/typescript-types@4.0.0(transitive)

• Updated@simplewebauthn/typescript-types@^5.0.0