Support for Secure Payment Confirmation

[benfoster]

Secure Payment Confirmation builds on top of WebAuthN and uses the Payment Request API to allow payments to be authenticated.

I've been able to adapt the demo application to use SPC but unfortunately the verification of the assertion fails because the type is no longer webauthn.get but payment.get (see AuthenticatorResponse).

Is it possible to override this verification or add support for additional client data types?

[aseigler]

Yeah, looks completely doable, and the architects built it to be so compatible by design.

[thomasnymand]

I have also stumbled on this issue. Any new considerations regarding possible override option or workaround?

[abergs]

I haven't paid too much attention to SPC. If someone is interested in doing a PoC Draft PR to show how we would implement this in a clean way I'd be interested in reviewing it.