Web/API/AuthenticatorAttestationResponse/attestationObject
Secure contextThis feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The attestationObject
property of the AuthenticatorAttestationResponse
interface returns an ArrayBuffer
containing the new public key, as well as signature over the entire attestationObject
with a private key that is stored in the authenticator when it is manufactured.
As part of the CredentialsContainer.create()
call, an authenticator will create a new keypair as well as an attestationObject for that keypair. The public key that corresponds to the private key that has created the attestation signature is well known; however, there are various well known attestation public key chains for different ecosystems (for example, Android or TPM attestations).
Syntax
attestObj = authenticatorAttestationResponse.attestationObject
Properties
After decoding the CBOR encoded ArrayBuffer
, the resulting JavaScript object will contain the following properties:
authData
- The same as
AuthenticatorAssertionResponse.authenticatorData
. Note that inAuthenticatorAssertionResponse
, theauthenticatorData
is exposed as a property in a JavaScript object while inAuthenticatorAttestationResponse
, theauthenticatorData
is a property in a CBOR map. - The same
AuthenticatorAssertionResponse.authenticatorData
field is used by bothAuthenticatorAttestationResponse
and byAuthenticatorAssertionResponse
. When used in attestation, it contains an optional field,attestedCredentialData
. This field is not included when used in theAuthenticatorAssertionResponse
. The attestedCredentialData field contains thecredentialId
andcredentialPublicKey
. fmt
- A text string that indicates the format of the attStmt. The WebAuthn specification defines a number of formats; however, formats may also be defined in other specifications and registered in an IANA registry. Formats defined by WebAuthn are:
"packed"
"tpm"
"android-key"
"android-safetynet"
"fido-u2f"
"none"
attStmt
- A an attestation statement that is of the format defined by
"fmt"
. For now, see the WebAuthn specification for details on each format.
Examples
var publicKey = {
challenge: /* from the server */,
rp: {
name: "Example CORP",
id : "login.example.com"
},
user: {
id: new Uint8Array(16),
name: "[email protected]",
displayName: "John Doe"
},
pubKeyCredParams: [
{
type: "public-key",
alg: -7
}
]
};
navigator.credentials.create({ publicKey })
.then(function (newCredentialInfo) {
var attestationObj = newCredentialInfo.response.attestationObject;
// This will be a CBOR encoded ArrayBuffer
// Do something with the response
// (sending it back to the relying party server maybe?)
}).catch(function (err) {
console.error(err);
});
Specifications
Specification | Status | Comment |
Web Authentication: An API for accessing Public Key Credentials Level 1The definition of 'attestationObject' in that specification. | Recommendation | Initial definition. |
Browser compatibility
The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Update compatibility data on GitHub
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
attestationObject
|
Chrome Full support 67 Full support 67 Full support 65 Notes' Only supports USB U2F tokens.
Disabled' From version 65: this feature is behind the |
Edge
Full support 18 |
Firefox Full support 60 Full support 60 Notes' Only supports USB U2F tokens. |
IE
No support No |
Opera
No support No |
Safari
Full support 13 |
WebView Android
Full support 70 |
Chrome Android
Full support 70 |
Firefox Android Full support 60 Full support 60 Notes' Only supports USB U2F tokens. |
Opera Android
No support No |
Safari iOS
Full support 13.3 |
Samsung Internet Android
Full support 10.0 |
Legend
- Full support
- Full support
- No support
- No support
- See implementation notes.'
- See implementation notes.
- User must explicitly enable this feature.'
- User must explicitly enable this feature.
See also
PublicKeyCredentialCreationOptions.challenge
: the cryptographic challenge which signature by the authenticator is contained inattStmt
PublicKeyCredentialCreationOptions.attestation
: the attestation statement transport option specified for the creation
AuthenticatorAttestationResponse.attestationObject by Mozilla Contributors is licensed under CC-BY-SA 2.5.