web/third_party/go-webauthn/CHANGELOG.md

0.17.1 (2026-05-03)

Bug Fixes

• protocol: remove unnecessary guard (#675) (1e07db1)
• webauthn: minimized encoding outputs (#670) (3847681)

0.17.0 (2026-04-21)

• fix!: split attestation type and format (#658) (3c1e870), closes #658 #476
• feat!: tighten cross-origin defaults (#647) (80cc224), closes #647

Bug Fixes

• protocol: short-circuit apple attestation extension lookup (#664) (5296bc7)

Features

• webauthn: add authenticator registration filtering (#668) (0be632e)
• webauthn: credential message pack (#660) (c7d933c)

BREAKING CHANGES

• A bug with the Credential Record which was introduced early in the libraries lifecycle has resulted in a breaking change to the Credential struct. If you are manually serializing this struct instead of using encoding/json you will be required to make manual changes; though Integrators should consider these notes regardless.

  • protocol.CredentialTypeFIDOU2F has been removed; replace uses with protocol.AttestationFormatFIDOUniversalSecondFactor (cast to string where the destination field is a plain string).

  • The semantics of the AttestationType field on webauthn.Credential and protocol.CredentialDescriptor have changed. Integrators that inspect this field to detect a format (typically checking for "fido-u2f") must switch to the new AttestationFormat field; the FIDO-U2F AppID and AppIDExclude extension helpers now key on AttestationFormat, so a descriptor literal constructed with AttestationType: "fido-u2f" will no longer trigger them.

  • Stored Credential JSON records are migrated transparently by the new UnmarshalJSON, but re-marshaled records will carry attestationFormat rather than a format string in attestationType; downstream consumers that parsed the legacy shape directly should be updated.

  • The Credential.Verify method has been updated and may fail in previous scenarios where it passed previously. It will also update the AttestationType value as a side-effect when used.

• The Cross-Origin verification semantics have changed significantly due to the stabilization of the WebAuthn Level 3 specification. It is no longer possible to disable verification, and Cross-Origin ceremonies must explicitly be allowed in this release.

  • protocol.TopOriginIgnoreVerificationMode has been removed. Code that referenced it must switch to one of the other constants as there is no longer a mode which disables the Top Origin verification such as:

    • TopOriginExplicitVerificationMode; match against RPTopOrigins only (recommended, and the new coerced default)
    • TopOriginAutoVerificationMode; match against the union of RPTopOrigins and RPOrigins
    • TopOriginImplicitVerificationMode; match against RPOrigins only

  • webauthn.Config.validate now rewrites a zero-valued RPTopOriginVerificationMode to TopOriginExplicitVerificationMode. Integrators that left the field unset previously got ignore-mode semantics (any Top Origin accepted); they now get strict matching against RPTopOrigins and must populate that list, or explicitly select a different mode; for Cross-Origin flows to succeed.

  • Cross-Origin ceremonies (those where the authenticator reports crossOrigin = true in the ClientData) are rejected by default. Integrators that rely on iframe-embedded or other Cross-Origin WebAuthn flows must set webauthn.Config.RPAllowCrossOrigin = true. The library continues to enforce Top Origin verification on accepted Cross-Origin ceremonies per the configured mode.

  • protocol.CollectedClientData.Verify no longer accepts TopOriginIgnoreVerificationMode; callers that pass an unknown mode receive ErrNotImplemented with detail "unknown Top Origin verification mode".

0.16.5 (2026-04-19)

Bug Fixes

• protocol: validate packed attca country (#656) (819edc8)
• webauthn: ensure challenge length is valid (#657) (85e9e68)

0.16.4 (2026-04-09)

0.16.3 (2026-04-05)

Bug Fixes

• webauthncose: replace elliptic (#635) (3b8a663)

Features

• metadata: update metadata authenticator statuses (#641) (95d28bc)
• webauthncose: add dilithium cose types (#636) (4106b24)

0.16.2 (2026-03-30)

Bug Fixes

• top origins always fails (#626) (514306b)
• webauthn: credential flags not fully updated (#629) (a4b68c8)
• webauthn: nil panic on discovery (#631) (3545ead)

Features

• webauthn: messagepack encoding (#621) (bf8fe28)

0.16.1 (2026-03-12)

Bug Fixes

• webauthncose: validate keys earlier (#615) (18ca901)

0.16.0 (2026-03-01)

Bug Fixes

• webauthn: empty top origins not allowed (#562) (fe3b74c), closes #537
• webauthn: session expiration not enforced (#561) (f5adbbf), closes #552

Features

• protocol: compound attestation statements (#571) (cc4e649)
• protocol: enhance rpid validation (#564) (7610304), closes #553
• protocol: signals structs (#574) (f75a34a)
• webauthncose: allow ber integers in ecdsa sigs (#593) (68db4d4), closes #408
• webauthn: return explicit error on unknown credential (#560) (1defb4a), closes #550

0.15.0 (2025-11-09)

0.14.0 (2025-09-14)

Bug Fixes

• webauthn: edge case in owned credentials validation (#487) (9410f91)
• webauthn: skip mds validation for none format (#497) (a1b2775), closes #387

Features

• metadata: update schema to 3.1 (#454) (3c6b5a1)
• protocol: att format updates (#485) (c079c8b)
• protocol: update tpm manufacturers (#496) (46046ca)
• protocol: validate native app origins (#468) (0b2a549), closes #462 #463

0.13.4 (2025-07-18)

Bug Fixes

• metadata: biometric accuracy descriptor types (#451) (c561b4d), closes #450

0.13.3 (2025-07-11)

Bug Fixes

• missing helpers (#444) (380a944)
• webauthn: missing passkey tooling (#443) (088d7c4)

0.13.1 (2025-07-06)

Bug Fixes

• protocol: conditional create uv check (#434) (2e13a60), closes #361

0.13.0 (2025-05-08)

Features

• protocol: cable transport (#418) (af19983)
• protocol: verify alg param during registration (#412) (4cad90a)

0.12.3 (2025-04-01)

Bug Fixes

• webauthn: empty aaguid fails login (#398) (4b7cd31)

0.12.2 (2025-03-10)

0.12.1 (2025-02-23)

0.12.0 (2025-02-23)

Bug Fixes

• metadata: cached file update fails without write access (#383) (1398e76)
• protocol: ensure attca is parsed correctly (#280) (ad0f7e2)
• webauthn: expose cred params functions (#286) (e736323)
• webauthn: login validates attestation format (#384) (a218507)

Features

• protocol: credential mediation (#361) (b9a233f), closes #347
• protocol: enhance errors (#341) (3207315), closes #365
• protocol: include intermediate certificate parsing (#345) (339114c)
• protocol: update tpm manufacturers (#374) (193f5b5)
• webauthn: add login option to manually set challenge (#359) (3a57554), closes #353
• webauthn: include new credential flags func (#337) (e5657ab)
• webauthn: json v2 partial and unsupported compat (#327) (bf37040)

0.11.2 (2024-08-25)

Bug Fixes

• protocol: out of date tpm manufacturers (#283) (13ad30e)

0.11.1 (2024-08-06)

Bug Fixes

• metadata: file closed too early (#273) (9ca2fae), closes #264
• metadata: functional opt sets wrong value (#272) (2b83ee0)

0.11.0 (2024-07-29)

• feat(metadata)!: rework as a provider (#239) (6713911), closes #239 #77 #154
• feat!: allow empty modality values (#257) (a5c838a), closes #257
• feat!: backup flag validation (#240) (2195f33), closes #240
• feat!: remove deprecated values (#233) (), closes #233 #221

Features

• config: allow rpid to be defined at execution time (#234) (c673c3d), closes #165
• parse credential bytes (#258) (b382edc)
• support hints and attestation formats (#216) (824017d)
• top origin verification (#217) (0c97761), closes #205
• webauthn level 3 (#232) (482cf89)

BREAKING CHANGES

• This change will require manual intervention from the implementer. Information is likely to be provided at a later date helping with the migrations required.
• This change will change default behaviour. Previously the required resident key value was set to false, and the user verification option was set to 'preferred'.
• This breaks implementations which do not strictly adhere to the specification. Several major providers either have or are currently "upgrading" existing WebAuthn credential records to BE and BS passkeys.

Co-authored-by: zahra.keshtkar zahra.keshtkar@snapp.cab

• the following fields and backwards compatible elements have been removed; Icon field from the CredentialEntity struct, WebAuthnIcon function from the User interface, RPIcon/RPOrigin/Timeout fields from the Config struct, Transports field from the CredentialCreationResponse (new field has existed in the AuthenticatorAttestationResponse struct for quite some time which matches the spec).

0.10.2 (2024-03-13)

0.10.1 (2024-02-08)

0.10.0 (2023-12-20)

Features

• credential struct tags for json serialization (#197) (99b2e0d)

0.9.4 (2023-12-02)

Bug Fixes

• protocol: trailing credential data skipped (#191) (e5a5571), closes #189

0.9.3 (2023-12-01)

Bug Fixes

• timeout config not propagating (#188) (1fc32f2)

0.9.2 (2023-11-28)

Bug Fixes

• protocol: display name omitted incorrectly (#184) (a602b39), closes #183

0.9.1 (2023-11-18)

Bug Fixes

• protocol: previous unmarshal functionality broken (#180) (68d2368)

0.9.0 (2023-11-18)

Features

• helper/convenience finish login function for discoverable functions (#173) (9cc24fa), closes #172

0.8.6 (2023-07-18)

0.8.5 (2023-07-16)

Bug Fixes

• protocol: attestation type attca not validated correctly (#153) (44d68a6), closes #149

0.8.4 (2023-07-06)

0.8.3 (2023-06-28)

Bug Fixes

• error hidden during discoverable login (#142) (a942e60), closes #140
• unnecessary field in session data (#141) (30ee1f3)

0.8.2 (2023-02-22)

Bug Fixes

• protocol: expose ccr/car parse method (#128) (709be4f)

0.8.1 (2023-02-19)

Bug Fixes

• error returned from new is inconsistent (#126) (cd86a1f)

0.8.0 (2023-02-19)

Bug Fixes

• validate configuration on all begin methods (#125) (e42df0d)

Features

• session expiration (#109) (e1d245d)
• webauthn: allow encoding user.id as a string (#124) (0948c14)

0.7.2 (2023-02-15)

Bug Fixes

• protocol: creation invalid transports path (#113) (3c168f4)
• protocol: missing attachment field (#114) (3386584)
• webauthn: missing important flag info from credential (#117) (1ee3a4a)
• webauthn: missing user display name from session (#116) (a51f98d)

Reverts

• fix(webauthn): missing user display name from session (#120) (33e2a9d)

0.7.1 (2023-02-11)

Bug Fixes

• missing base64 url encoding (#110) (42e66d8)

0.7.0 (2023-01-29)

Bug Fixes

• webauthncose: potential nil ptr in ec unmarshal (#102) (c3d789d)

Features

• protocol: add enterprise attestation preference (#100) (ad214bd), closes #90
• protocol: ignore padding for base64 url encoding (#95) (dca408e), closes #93
• protocol: native android fido2 origin (#94) (5f46788), closes #92

0.6.1 (2023-01-28)

Bug Fixes

• metadata: mds3 tests failure due to url change (#96) (83e3622)
• protocol: user entity id not encoded correctly (#98) (3d8dfc7), closes #97

0.6.0 (2022-12-18)

Bug Fixes

• challenge: urlsafe base64 encoding (#82) (6abd351)
• google tpm ec mapping (#43) (6be1bd6)
• protocol: potential panic in u2f attestation (#46) (59c2424)

Features

• add config option to add multiple rp origins (#81) (0bba500), closes #76
• expose credential parameter configuration (#40) (46f365d)
• metadata: mds3 support (#54) (697bc4c)
• protocol: added authentication transportation hybrid (#86) (752defd), closes #74
• protocol: implement device eligible and backup flags (#85) (694d289), closes #75
• refactor of tpm attestation (#60) (cdfc867)

0.3.3 (2022-06-24)

Bug Fixes

• webauthn: potential panic in parse fido public key (#39) (3551cfa)

0.3.2 (2022-06-24)

0.3.1 (2022-04-13)

0.3.0 (2022-04-06)

Features

• deps: remove module github.com/cloudflare/cfssl (#33) (c561447)

0.2.2 (2022-03-29)

Reverts

• remove resident key unrequired method (#30) (bd4f996)

0.2.1 (2022-03-01)

0.2.0 (2022-03-01)

Bug Fixes

• check the credential id length att data (#16) (b3b93ac)
• parse all transports even if unknown (#14) (729227d)
• unused json tag (#17) (4c7efcd)

Features

• add resident key protocol option (#13) (5ad54f8)
• add with setters for appid related extensions (#11) (d3212fe)
• discoverable login (#18) (401a3f6)

0.1.1 (2022-03-01)

Bug Fixes

• appid check (#3) (b71d523)
• encode hashes as hex (#6) (4697513)
• incorrect usage of subtle (#7) (70316cb)
• potential index out of range panic (#8) (2bbb113)
• use ctap2 cbor (#5) (497fae3)

0.1.0 (2021-12-15)

Bug Fixes

• missing extension results in parsed credential data (#13) (9c370fd)
• vuln sign count update on clone detected (#3) (5098308)
• webauthn: allowed credentials validation iteration logic failure (#10) (525b8d2)
• webauthn: config not honored in begin registration (#12) (f846cca)

Features

• accept transports information (#8) (738efed)
• appid extension (#7) (509e08f)

Reverts

• Revert "added codec tags for effortless attestation parsing (#14)" (8065b78), closes #14