Repository navigation
Reject credential IDs longer than 1023 bytes on registration - #517
Merged
Merged
Conversation
WebAuthn Level 3 says that credential IDs longer than 1023 bytes SHOULD cause the relying party to fail the registration ceremony. The attested credential data reads the ID length as a 16-bit value, so IDs of up to 65535 bytes were accepted. Verification now raises `WebAuthn::CredentialIdLengthVerificationError` for them. This check runs last, after all other registration checks. Because it is only a recommendation, a relying party can rescue the error and still store the credential, as with `WebAuthn::SignCountVerificationError`. https://www.w3.org/TR/webauthn-3/#sctn-registering-a-new-credential
nicolastemciuc
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
WebAuthn L3 specification recommends to fail if the credential ID is larger that 1023 bytes:
We are not checking this –
AttestedCredentialDatareadsbit16:id_length, so anything up to65535bytes is accepted.Details
This PR makes registration reject any credential whose ID is longer than 1023 bytes, which is the limit the WebAuthn spec sets. Verification now raises the new
WebAuthn::CredentialIdLengthVerificationErrorin that case.