Guidance for decoding/encoding protocol structs

[S0lomon]

Description

It would be nice if the documentation can provide some guidance for how to decode structs like CredentialCreation on the browser. It's clear by the library design and the example code that you're meant to send these as JSON encoded to the browser. Yet, that won't do you any good unless you have logic in the browser to decode and encode these data structures (in particular, correct encoding/decoding of the base64 buffers, and knowledge of which fields this applies to).

I saw an example where someone used this library that seems to do the decoding for them https://simplewebauthn.dev/ but it's unclear if go-webauthn and simplewebauthn are actually compatible and conform to a common standard, or if they just happen to work in this specific instance. (Another example mentioning simplewebauthn here)

Over all I'd say my experience with this library has been frustrating because of the lack of guidance around the encoding/decoding. It seems like a bridge that everyone has to cross to use the library, and I don't see any reason why there wouldn't be an out of the box solution to help beginners get started faster. Something like a 1 file of Javascript with helper functions for all the common data structures would be ideal.

Use Case

No response

Documentation

No response

[james-d-elliott]

See the spec for the standard format for a registration and authentication.

As these are standardized and the tooling should exist within the browser to achieve this output format per the spec (see the toJSON() method in the PublicKeyCredential Interface) we don't really have a lot of guidance to offer here.

The @simplewebauthn/browser library is going to follow the same struct that exists within the spec for the same reason we support this, generally I'd consider any implementation that does not support this as unsupported by us. I would also recommend using that library as it's maintained by one of the working group members that actively works in this space.

The only pain point realistically should be the userHandle which can be encoded in various ways.

[S0lomon]

Thanks for your time James. I realize this goes a bit beyond the spec of this library, but I'll leave this to hopefully help someone else in the future wondering the same as I was.

The reason why I thought I was missing something obvious is this: If the WebAuthentication standard is now supported in all major browsers, why do we need a third party browser library to achieve basic functionality? (all the examples I could find relevant to this library made it seem so).

After some digging I realized the browser API implements the necessary decoding logic. For example, registering a credential you can use PublicKeyCredential.parseCreationOptionsFromJSON and PublicKeyCredential.toJSON().

Thankfully, all the major browsers implement these methods, meaning simplewebauthn is probably unnecessary if you're willing to write a handful of extra lines yourself. However, these functions are a recent addition to the spec (technically still a "preview" edition) and were not widely available when most of the examples were written (such as https://github.com/go-webauthn/example).

[james-d-elliott]

Yeah those methods are relatively new. Which browsers currently support it other than Chrome based browsers? I'm surprised to even hear Chrome supports it.

[S0lomon]

Yeah those methods are relatively new. Which browsers currently support it other than Chrome based browsers? I'm surprised to even hear Chrome supports it.

Just based on what the Mozilla docs report, but for example:

Chrome 129 was released in September 2024. Safari support is still in preview.