WebauthnChallenge
in package
A started ceremony: the server's options plus the token binding a response to them (CONTRACT.md §24.1).
Table of Contents
Properties
- $challenge : array<string|int, mixed>
- $stateToken : Sensitive
Methods
- __construct() : mixed
- requestJson() : string
- The challenge in the JSON form every platform authenticator API takes (§24.6a rule 1).
Properties
$challenge
public
array<string|int, mixed>
$challenge
$stateToken
public
Sensitive
$stateToken
Methods
__construct()
public
__construct(array<string, mixed> $challenge, Sensitive $stateToken) : mixed
Parameters
- $challenge : array<string, mixed>
-
The server's options, exactly as they arrived — a
{"publicKey": {…}}object carrying base64url buffers. Hand it to the authenticator unchanged* (§24.0), or call self::requestJson() for the string a platform API takes. - $stateToken : Sensitive
-
Binds the authenticator's answer to this challenge. A bearer credential for the length of the ceremony — one that leaks inside that window is a ceremony an attacker can try to complete — so it is Sensitive (§24.5). It is opaque*: this SDK never decodes it, and neither should a caller.
requestJson()
The challenge in the JSON form every platform authenticator API takes (§24.6a rule 1).
public
requestJson() : string
This is the string a browser passes to PublicKeyCredential.parseCreationOptionsFromJSON()
and an Android app passes to CreatePublicKeyCredentialRequest. It is the inner options
object: the publicKey wrapper belongs to the DOM's CredentialCreationOptions, and the
platform JSON APIs do not want it.
Pure local computation, no I/O. Nothing is defaulted, dropped or reordered on the way through (§24.0).