passwordless-lib/fido2-net-lib

Should we remove `AuthenticatorAssertionRawResponse.AssertionResponse.AttestationObject`?

joegoldman2 opened this issue · 1 comments

AuthenticatorAssertionRawResponse.AssertionResponse currently contains a property AttestationObject:

[JsonPropertyName("attestationObject")]
[JsonConverter(typeof(Base64UrlConverter))]
public byte[]? AttestationObject { get; set; }

This property doesn't exist in the spec: https://www.w3.org/TR/webauthn-2/#iface-authenticatorassertionresponse.

Should we remove it?

I understand that this makes it possible to revalidate the stored attestation during the assertion validation. Closing the issue.