Pre-release 1.11.0-RC1

Deprecated features:

• AuthenticatorSelectionCriteria methods builder().requireResidentKey(boolean) and isRequireResidentKey() deprecated in favor of a new option, see below.
• The icon field in RelyingPartyIdentity and UserIdentity, and its associated methods, are now deprecated. The corresponding property was removed in WebAuthn Level 2.

Deprecated features will be removed in the next major version release.

Changes:

• RelyingParty.appId setting now also activates the appidExclude extension in addition to the appid extension.
• RelyingParty.startRegistration() now enables the credProps extension by default. The extension output, if any, is available as RegistrationResult.isDiscoverable() and RegistrationResult.getClientExtensionOutputs().getCredProps().

New features:

• RegistrationResult.keyId() now includes transports if any were included in the AuthenticatorAttestatationResponse. To get transports passed through, call PublicKeyCredential.response.getTransports() on the client side after successful registration, and add the result as the property response.transports in the JSON passed into PublicKeyCredential.parseRegistrationResponseJson. See the project README for an example.
• Added support for the appidExclude, credProps, largeBlob and uvm extensions.
• Added support for the new authenticatorSelectionCriteria.residentKey option:
  • Added method AuthenticatorSelectionCriteria.builder().residentKey(ResidentKeyRequirement).
  • Added method AuthenticatorSelectionCriteria.getResidentKey().
  • Methods builder().requireResidentKey(boolean) and isRequireResidentKey() deprecated in favor of the above two new methods.
  • The builder methods requireResidentKey(boolean) and residentKey(ResidentKeyRequirement) both control one shared setting, which sets both the requireResidentKey and residentKey options simultaneously and in agreement with each other for backwards compatibility with older browsers.
• Added methods PublicKeyCredentialCreationOptions.toCredentialsCreateJson(), PublicKeyCredentialRequestOptions.toCredentialsGetJson() and AssertionRequest.toCredentialsGetJson() for serializing to JSON without having to use Jackson directly.

Fixes:

• Added missing JavaDoc for id and name methods of initial RelyingPartyIdentityBuilder stages.

Artifacts built with openjdk 11.0.12 2021-07-20.

Version 1.10.1

webauthn-server-attestation:

• Fixed name of YubiKey Bio - FIDO edition in attestation metadata.

Artifacts built with openjdk 11.0.12 2021-07-20.

Version 1.10.0

webauthn-server-attestation:

• Added attestation metadata for YubiKey Bio.

Artifacts built with openjdk 11.0.11 2021-04-20.

Version 1.9.1

• Added missing <dependencyManagement> declaration to webauthn-server-attestation and webauthn-server-core POMs.

webauthn-server-attestation:

• Added attestation metadata for YubiKey 5 FIPS series.

Artifacts built with openjdk 11.0.11 2021-04-20.

Pre-release 1.9.1-RC2

webauthn-server-attestation:

• Added missing <dependencyManagement> declaration to webauthn-server-attestation POM.

Artifacts built with openjdk 11.0.11 2021-04-20.

Pre-release 1.9.1-RC1

webauthn-server-core:

• Added missing <dependencyManagement> declaration to webauthn-server-core POM.

Artifacts built with openjdk 11.0.11 2021-04-20.

Version 1.9.0

webauthn-server-attestation:

• Fixed that SimpleAttestationResolver would return empty transports when transports are unknown.

webauthn-server-core:

• Added support for the "apple" attestation statement format.

Other:

• Dependency versions moved to new meta-module webauthn-server-parent. Users should never need to depend on webauthn-server-parent directly.

Artifacts built with openjdk 11.0.11 2021-04-20.

Pre-release 1.9.0-RC2

• Dependency versions moved to new meta-module webauthn-server-parent. Users should never need to depend on webauthn-server-parent directly.

Artifacts built with openjdk 11.0.10 2021-01-19.

Pre-release 1.9.0-RC1

webauthn-server-attestation:

• Fixed that SimpleAttestationResolver would return empty transports when transports are unknown.

webauthn-server-core:

• Added support for the "apple" attestation statement format.

Artifacts built with openjdk 11.0.10 2021-01-19.

Version 1.8.0

Changes:

• BouncyCastle dependency is now optional.

  In order to opt out, depend on webauthn-server-core-minimal instead of webauthn-server-core. This is not recommended unless you know your JVM includes JCA providers for all signature algorithms.

  Note that webauthn-server-attestation still depends on BouncyCastle.

• Jackson deserializer for PublicKeyCredential now allows a rawId property to be present if id is not present, or if rawId equals id.

Artifacts built with openjdk 11.0.10 2021-01-19.