Is there a way to get the transports in fido server side?

[ranierimazili]

Hi,

on RP side, right after the credential creation call, I can get the transports like below:

const credential = await navigator.credentials.create({
        publicKey: publicKeyCredentialCreationOptions
});
credential.response.getTransports();

And the response will be something like:

['hybrid', 'internal']

When the necessary information is passed to the fido server to complete the registration, the transports looks undefined on authnrData:

Is this an information that can be obtained on fido server side or only on client side?

Thanks

[JamesCullum]

The transport is supposed to be copied over here: https://github.com/webauthn-open-source/fido2-lib/blob/master/lib/parser.js#L232
You can also check the rawAuthnrData if it contains any details.
If not, then your client is not packing the transport and would need to be packaged on the client side.

Summarized: The server can only read it if the client sends it. You must make sure that this is done by the client.

[ranierimazili]

First of all, thanks @JamesCullum for your incredible fast replies, you're helping me a lot.

Well, I'm using the chrome on windows and as fido device, my android mobile.
After the credential creation that I mentioned above, I'm sending the following to the fido server to complete the registration:

const parsedCredential = {
        id: credential.id,
        rawId: arrayBufferToBase64url(credential.rawId),
        response: {
            attestationObject: arrayBufferToBase64url(credential.response.attestationObject),
            clientDataJSON: arrayBufferToBase64url(credential.response.clientDataJSON),
            type: "public-key"
        }
}

So, all the fido server has is the parsedCredential to complete the registration. Is there any another object that I should send or the transports should be available somehow inside attestionObject or clientDataJSON objects?

[ranierimazili]

A desperate try to get an answer on ChatGPT giving the same information I did here gave me the following answer:

The reason why the transports value is coming as undefined on the server side may be related to the fact that, in the FIDO2 standard, the transport property is not part of the client response during registration. The transport is a property that makes more sense during authentication (verification) rather than during registration (credential creation).

During the registration process, the goal is to obtain a new authentication credential, and the transport associated with that credential will be determined during the subsequent authentication process.

If you need the transport during the authentication process, you should wait until the credential is used for authentication, and then check the associated transport on the server.

If you still find it necessary to obtain transport information during registration, you may consider adding that information as an additional step in your registration process, but that would be a specific implementation extension and not a standard part of the FIDO2 process.

Ensure that the library you are using on the server side is configured to handle the expected information during the authentication process rather than during the registration process.

Is this right?

[ranierimazili]

Based on @JamesCullum and ChatGPT answers, I think I've found the problem and a possible documentation enhancement.
On fido2-lib source-code, I've found the AttestationResult interface declaration as:

interface AttestationResult {
  id?: ArrayBuffer;
  rawId?: ArrayBuffer;
  transports?: string[];
  response: { clientDataJSON: string; attestationObject: string };
}

Look that there's a transports variable on it.
If passing it, the transports will be filled on registration result:

But, this variable (transports) is not documented as the other 3 on attestationResult method as a member of res attribute:

Maybe document the transports variable will make it more clear for those who wants to keep it on server side.

Thanks

[JamesCullum]

Thanks a lot for your research and suggestion! Do you want to improve the documentation to add this clarification? Feel free to create a PR whenever possible 👍