prf salts format between the server and the brwoser?

[Spomky]

Hi,

Is there any required format for the prf's first and second salts?
In the example shared here, the salt is just an UTF-8 text. But what if it is a binary string?
Does SimpleWebauthn convert those keys (base64url?) to pass arbitrary data?

Many thanks,
Regads.

[MasterKale]

Hello @Spomky, there's no required format for the salts. They're BufferSource in the spec which means ArrayBuffer in JavaScript:

https://w3c.github.io/webauthn/#dictdef-authenticationextensionsprfvalues

SimpleWebAuthn doesn't currently do anything to make extensions simpler to use. You can specify extensions as extensions when calling generateRegistrationOptions() and generateAuthenticationOptions() but the methods don't manipulate the extensions in anyway.

I think your best bet instead is to add the salts to the generated options afterwards, and then import { isoBase64URL } from '@simplewebauthn/server/helpers' to convert the salts to strings on the server to help get them to the browser. In the browser you can import { base64URLStringToBuffer } from '@simplewebauthn/browser' to get the salt bytes back into the ArrayBuffer that WebAuthn expects.