Secure context
This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The attestationObject
property of the AuthenticatorAttestationResponse
interface returns an ArrayBuffer
containing the new public key, as well as signature over the entire attestationObject
with a private key that is stored in the authenticator when it is manufactured.
As part of the CredentialsContainer.create()
call, an authenticator will create a new keypair as well as an attestationObject for that keypair. The public key that corresponds to the private key that has created the attestation signature is well known; however, there are various well known attestation public key chains for different ecosystems (for example, Android or TPM attestations).
Syntax
attestObj = authenticatorAttestationResponse.attestationObject
Properties
After decoding the CBOR encoded ArrayBuffer
, the resulting JavaScript object will contain the following properties:
authData
- The same as
AuthenticatorAssertionResponse.authenticatorData
. Note that inAuthenticatorAssertionResponse
, theauthenticatorData
is exposed as a property in a JavaScript object while inAuthenticatorAttestationResponse
, theauthenticatorData
is a property in a CBOR map. - The same
AuthenticatorAssertionResponse.authenticatorData
field is used by bothAuthenticatorAttestationResponse
and byAuthenticatorAssertionResponse
. When used in attestation, it contains an optional field,attestedCredentialData
. This field is not included when used in theAuthenticatorAssertionResponse
. The attestedCredentialData field contains thecredentialId
andcredentialPublicKey
. fmt
- A text string that indicates the format of the attStmt. The WebAuthn specification defines a number of formats; however, formats may also be defined in other specifications and registered in an IANA registry. Formats defined by WebAuthn are:
"packed"
"tpm"
"android-key"
"android-safetynet"
"fido-u2f"
"none"
attStmt
- A an attestation statement that is of the format defined by
"fmt"
. For now, see the WebAuthn specification for details on each format.
Examples
var publicKey = { challenge: /* from the server */, rp: { name: "Example CORP", id : "login.example.com" }, user: { id: new Uint8Array(16), name: "jdoe@example.com", displayName: "John Doe" }, pubKeyCredParams: [ { type: "public-key", alg: -7 } ] }; navigator.credentials.create({ publicKey }) .then(function (newCredentialInfo) { var attestationObj = newCredentialInfo.response.attestationObject; // This will be a CBOR encoded ArrayBuffer // Do something with the response // (sending it back to the relying party server maybe?) }).catch(function (err) { console.error(err); });
Specifications
Specification | Status | Comment |
---|---|---|
Web Authentication: An API for accessing Public Key Credentials Level 1 The definition of 'attestationObject' in that specification. |
Recommendation | Initial definition. |
Browser compatibility
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
attestationObject | Chrome
Full support
67
| Edge Full support 18 | Firefox
Full support
60
| IE No support No | Opera No support No | Safari Full support 13 | WebView Android Full support 70 | Chrome Android Full support 70 | Firefox Android
Full support
60
| Opera Android No support No | Safari iOS Full support 13.3 | Samsung Internet Android Full support 10.0 |
Legend
- Full support
- Full support
- No support
- No support
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.
See also
PublicKeyCredentialCreationOptions.challenge
: the cryptographic challenge which signature by the authenticator is contained inattStmt
PublicKeyCredentialCreationOptions.attestation
: the attestation statement transport option specified for the creation