Version 2.5.0

webauthn-server-core:

Breaking changes to experimental features:

• Added Jackson annotation @JsonProperty to method RegisteredCredential.isBackedUp(), changing the property name from backedUp to backupState. backedUp is still accepted during deserialization but will no longer be emitted during serialization.

New features:

• Added method .isUserVerified() to RegistrationResult and AssertionResult as a shortcut for accessing the UV flag in authenticator data.
• Updated README and JavaDoc to use the "passkey" term and provide more guidance around passkey use cases.
• Added Automatic-Module-Name to jar manifest.

Fixes:

• AuthenticatorAttestationResponse now tolerates and ignores properties "publicKey" and "publicKeyAlgorithm" during JSON deserialization. These properties are emitted by the PublicKeyCredential.toJSON() method added in WebAuthn Level 3.
• Relaxed Guava dependency version constraint to include major version 32.
• RelyingParty.finishAssertion now behaves the same if StartAssertionOptions.allowCredentials is explicitly set to a present, empty list as when absent.

webauthn-server-attestation:

New features:

• Added option verifyDownloadsOnly(boolean) to FidoMetadataDownloader. When set to true, the BLOB signature will not be verified when loading a BLOB from cache or when explicitly given. Default setting is false, which preserves the previous behaviour.
• Added Automatic-Module-Name to jar manifest.

Fixes:

• Made Jackson setting PROPAGATE_TRANSIENT_MARKER unnecessary for JSON serialization with Jackson version 2.15.0-rc1 and later.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.5.0-RC3

Fixes:

• RelyingParty.finishAssertion now behaves the same if StartAssertionOptions.allowCredentials is explicitly set to a present, empty list as when absent.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.5.0-RC2

Fixes:

• Relaxed Guava dependency version constraint to include major version 32.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.5.0-RC1

webauthn-server-core:

Breaking changes to experimental features:

• Added Jackson annotation @JsonProperty to method RegisteredCredential.isBackedUp(), changing the property name from backedUp to backupState. backedUp is still accepted during deserialization but will no longer be emitted during serialization.

New features:

• Added method .isUserVerified() to RegistrationResult and AssertionResult as a shortcut for accessing the UV flag in authenticator data.
• Updated README and JavaDoc to use the "passkey" term and provide more guidance around passkey use cases.
• Added Automatic-Module-Name to jar manifest.

Fixes:

• AuthenticatorAttestationResponse now tolerates and ignores properties "publicKey" and "publicKeyAlgorithm" during JSON deserialization. These properties are emitted by the PublicKeyCredential.toJSON() method added in WebAuthn Level 3.

webauthn-server-attestation:

New features:

• Added option verifyDownloadsOnly(boolean) to FidoMetadataDownloader. When set to true, the BLOB signature will not be verified when loading a BLOB from cache or when explicitly given. Default setting is false, which preserves the previous behaviour.
• Added Automatic-Module-Name to jar manifest.

Fixes:

• Made Jackson setting PROPAGATE_TRANSIENT_MARKER unnecessary for JSON serialization with Jackson version 2.15.0-rc1 and later.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Version 2.4.1

Changes:

• Added explicit version constraint on jackson-bom.

Fixes:

• Fixed incompatibility with Jackson version 2.15.0-rc1 and later.
• Fixed linking issue when running in Java 8.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.4.1-RC4

Fixes:

• Re-introduced version constraints on individual Jackson modules.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.4.1-RC3

Fixes:

• Fixed missing version number for jackson-bom dependencyManagement dependency.

Artifacts built with openjdk version "17.0.7" 2023-04-18.

Pre-release 2.4.1-RC2

Fixes:

• Added explicit dependencyManagement dependencies on jackson-bom and version constraint on jackson-bom.

Artifacts built with openjdk version "17.0.6" 2023-01-17.

Pre-release 2.4.1-RC1

Fixes:

• Removed version constraints on non-core Jackson modules; Jackson ships its own BOM constraints to align module versions.
• Fixed incompatibility with Jackson version 2.15.0-rc1 and later.
• Fixed linking issue when running in Java 8.

Artifacts built with openjdk version "17.0.6" 2023-01-17.

NOTE: The webauthn-server-attestation artifact of this version is not reliably reproducible; a single byte in MetadataStatement.class tends to differ between builds.

Version 2.4.0

webauthn-server-core:

New features:

• Added support for RS384 and RS512 signature algorithms.
  • Thanks to GitHub user JohnnyJayJay for the contribution, see #235
• Added userHandle field to AssertionRequest as part of the second bug fix below. userHandle is mutually exclusive with username. This was originally released in pre-release 1.12.3-RC3, but was accidentally left out of the 1.12.3 release.

Fixes:

• During RelyingParty.finishRegistration() if an attestationTrustSource is configured, if the aaguid in the authenticator data is zero, the call to AttestationTrustSource.findTrustRoots will fall back to reading the AAGUID from the attestation certificate if possible.
• Fixed bug in RelyingParty.finishAssertion where if StartAssertionOptions.userHandle was set, it did not propagate to RelyingParty.finishAssertion and caused an error saying username and user handle are both absent unless a user handle was returned by the authenticator. This was originally released in pre-release 1.12.3-RC3, but was accidentally left out of the 1.12.3 release.
• Fixed regression in PublicKeyCredentialCreationOptions.toCredentialsCreateJson(), which has not been emitting a requireResidentKey member since version 2.0.0. This meant the JSON output was not backwards compatible with browsers that only support the Level 1 version of the WebAuthn spec.

webauthn-server-attestation:

Fixes:

• findEntries and findTrustRoots methods in FidoMetadataService now attempt to read AAGUID from the attestation certificate if the aaguid argument is absent or zero.
• Method FidoMetadataService.Filters.allOf now has @SafeVarargs annotation.

Artifacts built with openjdk 17.0.6 2023-01-17.