refactor: encapsulate Credential Creation/Request Options #178
Conversation
|
|
||
| module WebAuthn | ||
| class CredentialOptions | ||
| CHALLENGE_LENGTH = 32 |
There was a problem hiding this comment.
should we allow challenge length configuration as long as we're on it? I mean, the standard states it should be at least 16, do you think it might be worth to allow them pass in the challenge length and validate it's bigger than 16 bytes?
Not that I would like to encourage people to use shorted and less secure challenges but some people might want to do it for some reason...?
There was a problem hiding this comment.
some people might want to do it for some reason...?
I think I would prefer to wait for someone to open an issue with a good reason to do that before providing that as an option.
|
Added an extra commit. |
|
|
||
| RSpec.describe WebAuthn::Credential::CreationOptions do | ||
| let(:creation_options) do | ||
| WebAuthn::Credential::CreationOptions.new(user_id: "1", user_name: "User", user_display_name: "User Display") |
There was a problem hiding this comment.
Still not sure about whether WebAuthn::Credential::CreationOptions or WebAuthn::CredentialCreationOptions...
There was a problem hiding this comment.
mmm I don't see them as models that will escalate further that these two, but the namespace doesn't hurt neither 🤷♂
There was a problem hiding this comment.
I think I am leaning towards flattening the namespace. I like it better from a user perspective.
No description provided.