Introduction
This document is about the APIs of the LINE FIDO2 Server application that has been released as open-source.
These define the messages exchanged between the RP server and LINE FIDO2 server.
For more information, please see README.md at the link below.
Basically, FIDO2 has the following operations - Registration, Authentication.
Example APIs worked like this:
-
Work with server-side credentials. (https://www.w3.org/TR/webauthn/#server-side-credential)
-
Use the platform authenticator in the Chrome browser on Mac OS.
-
Attestation Type is "NONE".
Registration
Registration consists of two APIs: an API for requesting a challenge, and an API for delivering the results of the client’s registration.
Get Reg Challenge
HTTP request
POST /fido2/reg/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 444
Host: localhost:8080
{
"rp" : {
"name" : "Test RP",
"icon" : null,
"id" : "localhost"
},
"user" : {
"name" : "TestUser",
"icon" : null,
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"displayName" : "Test Display Name"
},
"authenticatorSelection" : {
"authenticatorAttachment" : "platform",
"requireResidentKey" : true,
"userVerification" : "preferred"
},
"attestation" : "none",
"credProtect" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1471
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"rp" : {
"name" : "example1",
"icon" : null,
"id" : "localhost"
},
"user" : {
"name" : "TestUser",
"icon" : null,
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"displayName" : "Test Display Name"
},
"challenge" : "XR2NGK0HZW1-gUeuaPoLpf48ZFjz0sN2e5QfWZN7aIgjeXPksmJmJ0F0Oq9DHGZ74EvzejyEW6PHADMLxdqeng",
"pubKeyCredParams" : [ {
"type" : "public-key",
"alg" : -65535
}, {
"type" : "public-key",
"alg" : -257
}, {
"type" : "public-key",
"alg" : -258
}, {
"type" : "public-key",
"alg" : -259
}, {
"type" : "public-key",
"alg" : -37
}, {
"type" : "public-key",
"alg" : -38
}, {
"type" : "public-key",
"alg" : -39
}, {
"type" : "public-key",
"alg" : -7
}, {
"type" : "public-key",
"alg" : -35
}, {
"type" : "public-key",
"alg" : -36
}, {
"type" : "public-key",
"alg" : -8
}, {
"type" : "public-key",
"alg" : -43
} ],
"timeout" : 180000,
"excludeCredentials" : [ ],
"authenticatorSelection" : {
"authenticatorAttachment" : "platform",
"requireResidentKey" : true,
"userVerification" : "preferred"
},
"attestation" : "none",
"sessionId" : "6f5a8fbb-e801-4077-9b90-f5598a419604",
"extensions" : {
"credProps" : true
}
}
Send Reg Response
HTTP request
POST /fido2/reg/response HTTP/1.1
Content-Type: application/json
Content-Length: 1331
Host: localhost:8080
{
"serverPublicKeyCredential" : {
"id" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
"type" : "public-key",
"response" : {
"clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiSGw5eU4xRkh0T01ZdjJqOE1PVENQcmhRRFRSSGQ2Y2VCenFtMkhrMGxqTl9tR24yaUR6RzN5UGxoNEwtVTdzWTljc2FPZ1ZpWmJIZ0o5RU5xRDROMFEiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
"attestationObject" : "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjgSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFYW-p8K3OAAI1vMYKZIsLJfHwVQMAXAGBfoaAU4Skwz5aWbOYvsVwpj6acl7qhH_IND6QXJbCWkqp8TpAt6mt0FQHS3sgWr_tXKp0YYQd-GD7I0Ljdg5R9AJRgzYrE1Opot00EZzlEqqHUZGSgDyp8MerpQECAyYgASFYIIhbKqrHnS6kY-g57es_NRLrr7MUVaM1MNnjxYAjRFQYIlggKx3lFHU9zGTbdG2FSKqZODGdf47oYb-1SiCleHSTDgk",
"transports" : [ "internal" ]
},
"extensions" : {
"appid" : null,
"txAuthSimple" : null,
"txAuthGeneric" : null,
"authnSel" : null,
"exts" : null,
"uvi" : null,
"loc" : null,
"biometricPerfBounds" : null,
"credProps" : {
"rk" : true
}
}
},
"sessionId" : "fde89293-9dd4-4244-b7db-1df1086c7bc9",
"origin" : "http://localhost:8080",
"rpId" : "localhost",
"tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 475
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
"attestationType" : "NONE",
"authenticatorTransports" : [ "internal" ],
"userVerified" : true,
"rk" : true
}
Authentication
Authentication consists of two APIs: an API for requesting a challenge and an API for delivering the client’s authentication result.
Get Auth Challenge
HTTP request
POST /fido2/auth/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 122
Host: localhost:8080
{
"rpId" : "localhost",
"userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"userVerification" : "preferred"
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 624
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"challenge" : "nf15HXQ11EdR8ckcVJn-UDt59rHSnOF0JEgB53W65CZX2IL1pAf22XEIXnGnkCHssogQZ4VWHfDa3u7VSScEkw",
"timeout" : 180000,
"rpId" : "localhost",
"allowCredentials" : [ {
"type" : "public-key",
"id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc"
} ],
"userVerification" : "preferred",
"sessionId" : "048fc496-7de8-41e7-acf7-6da60885f436",
"extensions" : { }
}
Send Auth Response
HTTP request
POST /fido2/auth/response HTTP/1.1
Content-Type: application/json
Content-Length: 1310
Host: localhost:8080
{
"serverPublicKeyCredential" : {
"id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"type" : "public-key",
"response" : {
"clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoid19aOGctaklHdW5GYkM4S1g5THU0MThVUHV5RmNxQTlnM2ZqajVQRC1OdFYyWXA3R3dxeHdYdXJFNnRSZkp5V29rS21wV2R5c1VSS3lXRDRYNjJFb0EiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2UsIm90aGVyX2tleXNfY2FuX2JlX2FkZGVkX2hlcmUiOiJkbyBub3QgY29tcGFyZSBjbGllbnREYXRhSlNPTiBhZ2FpbnN0IGEgdGVtcGxhdGUuIFNlZSBodHRwczovL2dvby5nbC95YWJQZXgifQ",
"authenticatorData" : "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFYW-4ew",
"signature" : "MEYCIQC74yVXB6oz66Y1hfahBYnHvrhl42p8l2PWpGIPv2EgEgIhAM8ooggslk3efQhiulISGw489JMPQqTWjj0kRXvgc61G",
"userHandle" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk"
},
"extensions" : {
"appid" : null,
"txAuthSimple" : null,
"txAuthGeneric" : null,
"authnSel" : null,
"exts" : null,
"uvi" : null,
"loc" : null,
"biometricPerfBounds" : null,
"credProps" : null
}
},
"sessionId" : "c05c782a-77ca-4721-b523-19389bfcf3d7",
"origin" : "http://localhost:8080",
"rpId" : "localhost",
"tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 322
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"userVerified" : true,
"userPresent" : true
}
Credential API
These are not within the scope of the WebAuthn specification but its own APIs. |
Get Credential by CredentialId
HTTP request
GET /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Parameter | Description |
---|---|
|
credential Id |
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 966
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"credential" : {
"rpId" : "localhost",
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"name" : "TestUser",
"icon" : null,
"displayName" : "Test Display Name",
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
"algorithm" : "ES256",
"signCounter" : 1634711283,
"attestationType" : "NONE",
"transports" : null,
"rk" : true,
"credProtect" : 1,
"registeredAt" : "2021-10-20T06:27:17.595+00:00",
"authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
}
}
Get Credential by UserId
HTTP request
GET /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
|
true |
User Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 971
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
},
"credentials" : [ {
"rpId" : "localhost",
"id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
"name" : "TestUser",
"icon" : null,
"displayName" : "Test Display Name",
"aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
"credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
"publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
"algorithm" : "ES256",
"signCounter" : 1634711283,
"attestationType" : "NONE",
"transports" : null,
"rk" : true,
"credProtect" : 1,
"registeredAt" : "2021-10-20T06:27:17.595+00:00",
"authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
} ]
}
Delete Credential by CredentialId
HTTP request
DELETE /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Parameter | Description |
---|---|
|
credential Id |
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
}
}
Delete Credential by UserId
HTTP request
DELETE /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters
Parameter |
Required |
Description |
|
true |
RP Id |
|
true |
User Id |
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160
{
"serverResponse" : {
"description" : null,
"internalError" : "SUCCESS",
"internalErrorCode" : 0,
"internalErrorCodeDescription" : null
}
}
Health Check
This is not within the scope of the WebAuthn specification but its own API. |
Get Health Check Status
HTTP request
GET /health HTTP/1.1
Host: localhost:8080
HTTP response
HTTP/1.1 200 OK
Content-Type: text/plain;charset=UTF-8
Content-Length: 2
OK