AuthenticatorAttestationResponse.attestationObject
Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The attestationObject
property of the
AuthenticatorAttestationResponse
interface returns an
ArrayBuffer
containing the new public key, as well as signature over the
entire attestationObject
with a private key that is stored in the
authenticator when it is manufactured.
As part of the CredentialsContainer.create()
call, an authenticator will
create a new keypair as well as an attestationObject for that keypair. The public key
that corresponds to the private key that has created the attestation signature is well
known; however, there are various well known attestation public key chains for different
ecosystems (for example, Android or TPM attestations).
Value
After decoding the CBOR encoded
ArrayBuffer
, the resulting JavaScript object will contain the following
properties:
authData
-
The same as
AuthenticatorAssertionResponse.authenticatorData
. Note that inAuthenticatorAssertionResponse
, theauthenticatorData
is exposed as a property in a JavaScript object while inAuthenticatorAttestationResponse
, theauthenticatorData
is a property in a CBOR map.The same
AuthenticatorAssertionResponse.authenticatorData
field is used by bothAuthenticatorAttestationResponse
and byAuthenticatorAssertionResponse
. When used in attestation, it contains an optional field,attestedCredentialData
. This field is not included when used in theAuthenticatorAssertionResponse
. The attestedCredentialData field contains thecredentialId
andcredentialPublicKey
. fmt
-
A text string that indicates the format of the attStmt. The WebAuthn specification defines a number of formats; however, formats may also be defined in other specifications and registered in an IANA registry. Formats defined by WebAuthn are:
"packed"
"tpm"
"android-key"
"android-safetynet"
"fido-u2f"
"none"
attStmt
-
An attestation statement that is of the format defined by
"fmt"
. For now, see the WebAuthn specification for details on each format.
Examples
var publicKey = {
challenge: /* from the server */,
rp: {
name: "Example CORP",
id : "login.example.com"
},
user: {
id: new Uint8Array(16),
name: "jdoe@example.com",
displayName: "John Doe"
},
pubKeyCredParams: [
{
type: "public-key",
alg: -7
}
]
};
navigator.credentials.create({ publicKey })
.then(function (newCredentialInfo) {
var attestationObj = newCredentialInfo.response.attestationObject;
// This will be a CBOR encoded ArrayBuffer
// Do something with the response
// (sending it back to the relying party server maybe?)
}).catch(function (err) {
console.error(err);
});
Specifications
Specification |
---|
Web Authentication: An API for accessing Public Key Credentials - Level 3 # dom-authenticatorattestationresponse-attestationobject |
Browser compatibility
BCD tables only load in the browser
See also
-
PublicKeyCredentialCreationOptions.challenge
: the cryptographic challenge which signature by the authenticator is contained inattStmt
-
PublicKeyCredentialCreationOptions.attestation
: the attestation statement transport option specified for the creation