WebAuthn largeBlob extension

[lmarschall]

Heyho,

so with IOS 17 around the corner, there will be support for the largeBlob extension for WebAuthn.
https://webkit.org/blog/14205/news-from-wwdc23-webkit-features-in-safari-17-beta/
https://www.w3.org/TR/webauthn-2/#sctn-large-blob-extension

I was wondering if this is a desired feature for this package, because I would love to see the implementation, considering the possible use cases. For example, storing private keys.

Looking forward for your thoughts on this topic.

Cheers,

Lukas

[lmarschall]

Some more information about implementation from mozilla:
https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#largeblob

[MasterKale]

So extensions have never been incompatible with SimpleWebAuthn, but they definitely require the RP to know about them and how to serialize them. Not exactly simple.

The problem with adding support for largeBlob is that there's no single use case to design a simple API around. Are the bytes you're storing for cert-based SSH authentication with a security key in a CLI tool? Are you storing a credential of some kind to be verified later? Maybe the bytes are for some kind of crazy stateless account UI customization schema the RP has concocted. I can't ever know all the possible use cases ahead of time...

One possibility that came to mind is that I can expose @simplewebauthn/browser's base64url <> bytes helper methods. I can see this making it easier for RP's using an extension like largeBlob to serialize and deserialize the bytes into and from the extension, and help get the values to and from the server via JSON 🤔

[lmarschall]

Hey @MasterKale,

thank you for the evaluation. I'm currently getting myself into the topic and certainly don't have that much experience yet regarding Webauthn externsions. I'll try to implement a cert storing use case in the future.