FIDO2 authentication options

POST 
/nevisfido/fido2/assertion/options

This endpoint performs the same first step of the FIDO2/WebAuthn flow as the attestation options endpoint, but is dedicated exclusively to the authentication ceremony. It is provided to satisfy the FIDO2 server conformance test suite, which requires separate paths for registration and authentication options. The server returns a challenge and allowed credential list that the client passes to the WebAuthn browser API to invoke the user's authenticator for a sign-in operation. In typical nevisFIDO deployments the attestation options endpoint is used for both ceremonies, making this endpoint an alternative for conformance and interoperability purposes.

Request

Header Parameters

headers objectrequired

application/json

Body

required

Authentication request example

extensions object
appid string
appidExclude string
uvm boolean
credProps boolean
credentialProtectionPolicy string
Possible values: [userVerificationOptional, userVerificationOptionalWithCredentialIDList, userVerificationRequired]
enforceCredentialProtectionPolicy boolean
hmacCreateSecret boolean
hmacGetSecret object
salt1 byte
salt2 byte
username string
userVerification string

Responses

200

OK The server processed the request successfully. A ServerPublicKeyCredentialGetOptionsResponse JSON object is returned.

*/*

Schema

Schema

oneOf
ServerPublicKeyCredentialGetOptionsResponse
timeout int64
extensions object
appid string
appidExclude string
uvm boolean
credProps boolean
credentialProtectionPolicy string
Possible values: [userVerificationOptional, userVerificationOptionalWithCredentialIDList, userVerificationRequired]
enforceCredentialProtectionPolicy boolean
hmacCreateSecret boolean
hmacGetSecret object
salt1 byte
salt2 byte
rpId string
userVerification string
challenge string
allowCredentials object[]
Array [
type string
id string
transports string[]
]
status string
Possible values: [ok, failed]
errorMessage string
fido2SessionId string

Example (from schema)

{}

405

Method Not Allowed The method of the received request was not POST.

406

Not Acceptable The Accept header is not properly set to application/json.

415

Unsupported Media Type The Content-Type header is not properly set to application/json;charset=UTF-8.

Loading...