Equivalent of advancedFIDOConfig in verifyAuthenticationResponse for verifyRegistrationResponse?

[agektmr]

I wonder why verifyAuthenticationResponse has advancedFIDOConfig while verifyRegistrationResponse does not. It would be handy if they are symmetric.

[MasterKale]

Hey @agektmr, good question! advancedFIDOConfig only came to be because of FIDO Conformance testing. There's a FIDO-specific requirement that an RP support optional User Presence during authentication and so I added that in to be able to pass those tests:

Several issues have come in recently about failing FIDO Conformance tests. While ideologically I disagree with the tests that require support for non-true authentication (they technically violate the WebAuthn spec which requires up to always be true), users of my library may wish to implement FIDO conformant RP servers with it.

From #253 (comment)

I continue to disagree with the importance of supporting this use case but alas, FIDO Conformance is what it is 🤷‍♂️

[MasterKale]

Interestingly there's no such requirement for registration so advancedFIDOConfig never ended up in verifyRegistrationResponse() 🤔

[agektmr]

Thanks for clarification, Matt. I understood. I thought it might be handy to add advancedFIDOConfig to verifyRegistrationResponse() but you are right, supporting "uv=preferred" on the server doesn't make sense.