passwordless-lib/fido2-net-lib

Confusing API: MakeAssertionAsync

glatzert opened this issue · 4 comments

The function

Task<VerifyAssertionResult> MakeAssertionAsync(
IFido2.MakeAssertionAsync() returns an instance of VerifyAssertionResult. This leads to questions and some confusion about how to use it:

  1. The return type contains an status and an errorMessage, that is used in the samples like here , but will never be anything else then { status = "ok" } and errorMessage = null despite the sample indicating otherwise. MakeAssertionAsync() will always throw on error, which is okay, but should be clearly communicated.
  2. the VerifyAssertionResult.Status property is of type string and is neither populated by an enum nor by an constant, so if that property is relevant, the caller needs to read the code to understand the possible values.

I propose:

  • removing the inheritance of VerifyAssertionResult to Fido2ResponseBase since that brings in the two problematic fields.
  • adding a bool to VerifyAssertionResult indicating successful verification and thus remove all throws and replace it with return VerifiyAssertionResult.Error(string reason) setting that bool to false (or an enum indicating success and failure to make it clearly distinguishable).

If you'd accept the Idea, I'd implement it and provide a PR.