AuthenticatorAttestationResponse: attestationObject property
Baseline
Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since September 2021.
Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The attestationObject property of the
AuthenticatorAttestationResponse interface returns an
ArrayBuffer containing the new public key, as well as signature over the
entire attestationObject with a private key that is stored in the
authenticator when it is manufactured.
As part of the CredentialsContainer.create() call, an authenticator will
create a new key pair as well as an attestationObject for that key pair. The public key
that corresponds to the private key that has created the attestation signature is well
known; however, there are various well known attestation public key chains for different
ecosystems (for example, Android or TPM attestations).
Value
After decoding the CBOR encoded
ArrayBuffer, the resulting JavaScript object will contain the following
properties:
authData-
The Authenticator data for the operation. Note that in
AuthenticatorAssertionResponse, theauthenticatorDatais exposed as a property in a JavaScript object (seeAuthenticatorAssertionResponse.authenticatorData) while inAuthenticatorAttestationResponse, theauthenticatorDatais a property in a CBOR map.The same
AuthenticatorAssertionResponse.authenticatorDatafield is used by bothAuthenticatorAttestationResponseand byAuthenticatorAssertionResponse. When used in attestation, it contains an optional field,attestedCredentialData. This field is not included when used in theAuthenticatorAssertionResponse. The attestedCredentialData field contains thecredentialIdandcredentialPublicKey. fmt-
A text string that indicates the format of the attStmt. The WebAuthn specification defines a number of formats; however, formats may also be defined in other specifications and registered in an IANA registry. Formats defined by WebAuthn are:
"packed""tpm""android-key""android-safetynet""fido-u2f""none"
attStmt-
An attestation statement that is of the format defined by
"fmt". For now, see the WebAuthn specification for details on each format.
Examples
See Creating a public key credential for a detailed example.
Specifications
| Specification |
|---|
| Web Authentication: An API for accessing Public Key Credentials - Level 3 # dom-authenticatorattestationresponse-attestationobject |
Browser compatibility
| desktop | mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
attestationObject
|
|
|
|
|
|
|
|
|
|
|
|
|
Legend
Tip: you can click/tap on a cell for more information.
- Full support
- Full support
- Partial support
- Partial support
- No support
- No support
- See implementation notes.
- Has more compatibility info.
See also
CredentialsContainer.create(): the method used to create a statement with a cryptographicchallengewhich signature by the authenticator is contained inattStmt, with the specifiedattestationtransport option.