Opt-out of backup elligible checking for a given credential

[erincandescent]

Description

I have a service which used an older version of this library to implement webauthn. Users enrolled credentials for which the Backup Elligible flag wasn't stored. I would like a way to flag to the library that this information is unknown and should not be validated

The obvious solution would be to make the the BackupEligible flag a three valued type (true, fals, unknown) but that obviously poses compatibility challenges.

Use Case

Users who enrolled to my service for which the Backup Elligible flag wasn't stored should be able to login.

Documentation

No response

[erincandescent]

n.b. currently i'm pinning 0.10.2 but this isn't a long-term sustainable option.

[james-d-elliott]

Why not handle this via determining if the value was ever stored in your storage solution (i.e. nullable column) and on login update the credential in that instance to the attested value?

[erincandescent]

That's what I want to do, but I haven't spotted any way to do this other than opting out of the checking for the user's first login after upgrading?

[james-d-elliott]

You should be able during the parsing phase to detect the current flags from the credential following this path:

1. Use protocol.ParseCredentialRequestResponse to parse the response from the authenticator.
2. Load credentials with a null-like value which match the requested credential and update them if returned using the following structure path from the result from 1 i.e. .Response.AuthenticatorData.Flags:
   1. https://pkg.go.dev/github.com/go-webauthn/webauthn/protocol#ParsedAssertionResponse
   2. https://pkg.go.dev/github.com/go-webauthn/webauthn/protocol#AuthenticatorData
   3. https://pkg.go.dev/github.com/go-webauthn/webauthn/protocol#AuthenticatorFlags
3. Use webauthn WebAuthn.ValidateLogin or webauthn WebAuthn.ValidateDiscoverableLogin to validate the updated credential (if you're using the discoverable one you'll have to update it as part of the user lookup func).