Introduction
This document is about the APIs of the LINE FIDO2 Server application that has been released as open-source.
These define the messages exchanged between the RP server and LINE FIDO2 server.
For more information, please see README.md at the link below.
If you want to know the details of the WebAuthn standard, you can also refer to the official documentation.
Basically, FIDO2 has the following operations - Registration, Authentication.
Example APIs worked like this:
-
Work with server-side credentials. (https://www.w3.org/TR/webauthn/#server-side-credential)
-
Use the platform authenticator in the Chrome browser on Mac OS.
-
Attestation Type is "NONE".
Registration
Registration consists of two APIs: an API for requesting a challenge, and an API for delivering the results of the client’s registration.
Get Reg Challenge
HTTP request
POST /fido2/reg/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 444
Host: localhost:8080
{
"rp" : {
"name" : "Test RP",
"icon" : null,
"id" : "localhost"
},
"user" : {
"name" : "TestUser",
"icon" : null,
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"displayName" : "Test Display Name"
},
"authenticatorSelection" : {
"authenticatorAttachment" : "platform",
"requireResidentKey" : true,
"userVerification" : "preferred"
},
"attestation" : "none",
"credProtect" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1471
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"rp" : {
"name" : "example1",
"icon" : null,
"id" : "localhost"
},
"user" : {
"name" : "TestUser",
"icon" : null,
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"displayName" : "Test Display Name"
},
"challenge" : "TXgZfiz2B88oNbksOpC4GjNQ8YNaFzntXMBTMdN3K1XgIgKRr3FoXltAhV1zNmmdF4WJhxnoQDeq4s0bARhtRg",
"pubKeyCredParams" : [ {
"type" : "public-key",
"alg" : -65535
}, {
"type" : "public-key",
"alg" : -257
}, {
"type" : "public-key",
"alg" : -258
}, {
"type" : "public-key",
"alg" : -259
}, {
"type" : "public-key",
"alg" : -37
}, {
"type" : "public-key",
"alg" : -38
}, {
"type" : "public-key",
"alg" : -39
}, {
"type" : "public-key",
"alg" : -7
}, {
"type" : "public-key",
"alg" : -35
}, {
"type" : "public-key",
"alg" : -36
}, {
"type" : "public-key",
"alg" : -8
}, {
"type" : "public-key",
"alg" : -43
} ],
"timeout" : 180000,
"excludeCredentials" : [ ],
"authenticatorSelection" : {
"authenticatorAttachment" : "platform",
"requireResidentKey" : true,
"userVerification" : "preferred"
},
"attestation" : "none",
"sessionId" : "8bfc693e-8582-45e1-ad08-e2b71901cc97",
"extensions" : {
"credProps" : true
}
}
Send Reg Response
HTTP request
POST /fido2/reg/response HTTP/1.1
Content-Type: application/json
Content-Length: 1331
Host: localhost:8080
{
"serverPublicKeyCredential" : {
"id" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
"type" : "public-key",
"response" : {
"clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiSGw5eU4xRkh0T01ZdjJqOE1PVENQcmhRRFRSSGQ2Y2VCenFtMkhrMGxqTl9tR24yaUR6RzN5UGxoNEwtVTdzWTljc2FPZ1ZpWmJIZ0o5RU5xRDROMFEiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
"attestationObject" : "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjgSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFYW-p8K3OAAI1vMYKZIsLJfHwVQMAXAGBfoaAU4Skwz5aWbOYvsVwpj6acl7qhH_IND6QXJbCWkqp8TpAt6mt0FQHS3sgWr_tXKp0YYQd-GD7I0Ljdg5R9AJRgzYrE1Opot00EZzlEqqHUZGSgDyp8MerpQECAyYgASFYIIhbKqrHnS6kY-g57es_NRLrr7MUVaM1MNnjxYAjRFQYIlggKx3lFHU9zGTbdG2FSKqZODGdf47oYb-1SiCleHSTDgk",
"transports" : [ "internal" ]
},
"extensions" : {
"appid" : null,
"txAuthSimple" : null,
"txAuthGeneric" : null,
"authnSel" : null,
"exts" : null,
"uvi" : null,
"loc" : null,
"biometricPerfBounds" : null,
"credProps" : {
"rk" : true
}
}
},
"sessionId" : "fde89293-9dd4-4244-b7db-1df1086c7bc9",
"origin" : "http://localhost:8080",
"rpId" : "localhost",
"tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 475
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
"attestationType" : "NONE",
"authenticatorTransports" : [ "internal" ],
"userVerified" : true,
"rk" : true
}
Authentication
Authentication consists of two APIs: an API for requesting a challenge and an API for delivering the client’s authentication result.
Get Auth Challenge
HTTP request
POST /fido2/auth/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 122
Host: localhost:8080
{
"rpId" : "localhost",
"userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"userVerification" : "preferred"
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 624
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"challenge" : "7ZKNccKcYL0Rky0YqVx-_-yHDudCPScBayiw17arUfzpAfqa-A8nv-OmQbSLMHtpEE0rp0MbblIzLw-bE5x6zQ",
"timeout" : 180000,
"rpId" : "localhost",
"allowCredentials" : [ {
"type" : "public-key",
"id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc"
} ],
"userVerification" : "preferred",
"sessionId" : "3d310653-8d7a-449e-975e-30a467dfbe9a",
"extensions" : { }
}
Send Auth Response
HTTP request
POST /fido2/auth/response HTTP/1.1
Content-Type: application/json
Content-Length: 1310
Host: localhost:8080
{
"serverPublicKeyCredential" : {
"id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"type" : "public-key",
"response" : {
"clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoid19aOGctaklHdW5GYkM4S1g5THU0MThVUHV5RmNxQTlnM2ZqajVQRC1OdFYyWXA3R3dxeHdYdXJFNnRSZkp5V29rS21wV2R5c1VSS3lXRDRYNjJFb0EiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2UsIm90aGVyX2tleXNfY2FuX2JlX2FkZGVkX2hlcmUiOiJkbyBub3QgY29tcGFyZSBjbGllbnREYXRhSlNPTiBhZ2FpbnN0IGEgdGVtcGxhdGUuIFNlZSBodHRwczovL2dvby5nbC95YWJQZXgifQ",
"authenticatorData" : "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFYW-4ew",
"signature" : "MEYCIQC74yVXB6oz66Y1hfahBYnHvrhl42p8l2PWpGIPv2EgEgIhAM8ooggslk3efQhiulISGw489JMPQqTWjj0kRXvgc61G",
"userHandle" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk"
},
"extensions" : {
"appid" : null,
"txAuthSimple" : null,
"txAuthGeneric" : null,
"authnSel" : null,
"exts" : null,
"uvi" : null,
"loc" : null,
"biometricPerfBounds" : null,
"credProps" : null
}
},
"sessionId" : "c05c782a-77ca-4721-b523-19389bfcf3d7",
"origin" : "http://localhost:8080",
"rpId" : "localhost",
"tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 322
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"userVerified" : true,
"userPresent" : true
}
Credential API
These are not within the scope of the WebAuthn specification but its own APIs. |
Get Credential by CredentialId
HTTP request
GET /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Parameter | Description |
---|---|
|
credential Id |
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 966
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"credential" : {
"rpId" : "localhost",
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"name" : "TestUser",
"icon" : null,
"displayName" : "Test Display Name",
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
"algorithm" : "ES256",
"signCounter" : 1634711283,
"attestationType" : "NONE",
"transports" : null,
"rk" : true,
"credProtect" : 1,
"registeredAt" : "2021-10-20T06:27:17.595+00:00",
"authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
}
}
Get Credential by UserId
HTTP request
GET /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
|
true |
User Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 971
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"credentials" : [ {
"rpId" : "localhost",
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"name" : "TestUser",
"icon" : null,
"displayName" : "Test Display Name",
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
"algorithm" : "ES256",
"signCounter" : 1634711283,
"attestationType" : "NONE",
"transports" : null,
"rk" : true,
"credProtect" : 1,
"registeredAt" : "2021-10-20T06:27:17.595+00:00",
"authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
} ]
}
Delete Credential by CredentialId
HTTP request
DELETE /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Parameter | Description |
---|---|
|
credential Id |
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
}
}
Delete Credential by UserId
HTTP request
DELETE /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
|
true |
User Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
}
}
Health Check
This is not within the scope of the WebAuthn specification but its own API. |
Get Health Check Status
HTTP request
GET /health HTTP/1.1
Host: localhost:8080
HTTP response
HTTP/1.1 200 OK
Content-Type: text/plain;charset=UTF-8
Content-Length: 2
OK