FIDO2 - Conformance API - username / userhandle

[Dani Mező]

Hi devs, Yuriy,

So I noticed, that in the Authentication ceremony, for both request the client sends user info to the server in the conformance api (username & userHandle). Why is that? Is it not sufficient to send a username in the original and get on with it, why is it needed to send down the userID as well - is it not the server's responsibility to figure that out?

1st. request:

dictionary ServerPublicKeyCredentialGetOptionsRequest { 

   required DOMString username; 

   UserVerificationRequirement userVerification = "preferred"; 

 };

2nd. request:

dictionary ServerAuthenticatorAssertionResponse : ServerAuthenticatorResponse {

 required DOMString clientDataJSON; 

 required DOMString authenticatorData; 

 required DOMString signature; required DOMString userHandle; 

};

Cheers, Daniel