security - YubiKey + Webauth : userHandle is always null

Question

当我使用 WebAuthn 和我的 YubiKey 进行身份验证时，response.userHandle 属性始终为 null。那是我注册凭据的用户 ID 和显示名称不会返回。这是因为我在注册/身份验证过程中做错了什么吗:

async function register() {
  const publicKeyCredentialCreationOptions = {
    challenge: Uint8Array.from("this-is-a-test", (c) => c.charCodeAt(0)),
    rp: {
      name: "Webauthn Test",
      id: "localhost",
    },
    user: {
      id: Uint8Array.from("a1b2c3d4e5f6", (c) => c.charCodeAt(0)),
      name: "just-a-test",
      displayName: "MrUser",
    },
    pubKeyCredParams: [{ alg: -7, type: "public-key" }],
    authenticatorSelection: {
      authenticatorAttachment: "cross-platform",
    },
    timeout: 60000,
    attestation: "direct",
  };

  const credential = await navigator.credentials.create({
    publicKey: publicKeyCredentialCreationOptions,
  });
}

这是我用来验证的代码:

async function authenticate() {
  const publicKeyCredentialRequestOptions = {
    challenge: Uint8Array.from("test", (c) => c.charCodeAt(0)),
    allowCredentials: [
      {
        id: credentialId,
        type: "public-key",
        transports: ["usb", "ble", "nfc"],
      },
    ],
    timeout: 60000,
  };

  const assertion = await navigator.credentials.get({
    publicKey: publicKeyCredentialRequestOptions,
  });

  console.log(assertion);
}

我最终得到的是:

{
  rawId: ArrayBuffer(64),
  id: "U-nitqhlORmmdltp7TLO3i18KNoWsSebFyrtc3OIRvcktvwlz-dJZCA1_1gxXrNHzqReU7xGAHdfVP75N2aJSw", 
  response: {
    authenticatorData: ArrayBuffer(37) {}
    clientDataJSON: ArrayBuffer(101) {}
    signature: ArrayBuffer(71) {}
    userHandle: null
  }
  type: "public-key"
}

As you can see: userHandle is null.  Can anyone tell me why?

Answer 1

userHandle 可以为空，具体取决于依赖方请求创建的 WebAuthn 凭证类型。

默认的 WebAuthn 行为将创建一个不可发现的凭证，断言中返回的 userHandle 将为空。此类凭据的身份验证器上未存储任何数据，因此没有任何可返回的内容。

要创建 WebAuthn 客户端可发现凭证，也称为常驻 key ，您必须将 requireResidentKey 成员设置为 true。这会将凭证数据存储在身份验证器上，并将在断言中返回 userHandle。引用AuthenticatorSelectionCriteria in the W3C WebAuthn spec了解详情。

这是一个例子:

authenticatorSelection: {
  authenticatorAttachment: "cross-platform",
  requireResidentKey: true
},

参见 Yubico's WebAuthn Dev Guide了解更多 resident keys和 userHandle .