Ready for Trial: WebAuthn: Large blob storage extension (largeBlob)
Nina Satragno
Contact emails
nsat...@chromium.org, mart...@chromium.org, a...@chromium.orgExplainer
https://w3c.github.io/webauthn/#sctn-large-blob-extensionSpecification
https://w3c.github.io/webauthn/#sctn-large-blob-extensionSummary
Adds support for the WebAuthn largeBlob client authenticator extension. This extension allows relying parties to store opaque data associated with a credential.
Blink component
Blink>WebAuthenticationSearch tags
webauthn, large blob, blobsTAG review
N/ATAG review status
Not applicableRisks
Interoperability and Compatibility
Low, this is a new feature that's already part of the editor's draft [1] for WebAuthn. [1] https://w3c.github.io/webauthn/#sctn-large-blob-extension
Gecko: No signal
WebKit: No signal
Web developers: No signals
Ergonomics
WebAuthn is already an asynchronous API with a "long" time to get a response (in the order of seconds) since it needs user interaction. Adding this feature will not impact the "normal" webauthn flow. For relying parties (i.e. websites) using it, it won't significantly affect performance.
Activation
This feature can't be polyfilled since it relies on hardware support. Effectively the feature only exposes three methods as parameters on webauthn request options: querying for support, writing, and reading blobs. Integration with existing frameworks exercising webauthn should be straightforward.
Security
The implementation requires compressing and uncompressing arbitrary data. This is done in the data decoder service [1], which runs in a sandboxed process. This implementation feature was security-reviewed [2]. [1] https://source.chromium.org/chromium/chromium/src/+/master:services/data_decoder/gzipper.h [2] https://chromium-review.googlesource.com/c/chromium/src/+/2464011
Goals for experimentation
We are planning to slowly introduce this feature into the ecosystem to gather feedback.
Ongoing technical constraints
None
Debuggability
Developers can use the devtools webauthn tab to debug this feature. https://developers.google.com/web/tools/chrome-devtools/webauthn
Will this feature be supported on all six Blink platforms (Windows, Mac, Linux, Chrome OS, Android, and Android WebView)?
NoThis feature will be supported on mac, linux, windows < 10 19h1, & chrome os. Windows >= 10 19h1 blocks access to authenticators through low-level APIs and relies on a high-level API that does not support this feature at the moment. Similarly, the android webauthn implementation relies on a higher level API that does not support this feature.