Skip to content

Attestation and metadata statement

Warning

Disclaimer: you should not ask for the Attestation Statement unless you are working on an application that requires a high level of trust (e.g. Banking/Financial Company, Government Agency...).

With Symfony, you must enable this feature and define a Metadata Statement Repository in the configuration file.

config/packages/webauthn.yaml
webauthn:
    metadata_service:
        enabled: true
        mds_repository: 'App\Repository\MyMetadataStatementRepository'
        status_report_repository: 'App\Repository\MyStatusReportRepository'

Warning

The MDS and Status Report repositories shall implement Webauthn\MetadataService\MetadataStatementRepository and Webauthn\MetadataService\StatusReportRepository respectively

Danger

If the metadata service is not enabled, the Attestation Statement Formats other than None (e.g. Apple, Packed, TPM...) cannot be used.

Credential creation options

By default, no Attestation Statement is asked to the Authenticators (type = none). To change this behavior, you just have to set the corresponding parameter in the Webauthn\PublicKeyCredentialCreationOptions object.

There are 3 conveyance modes available using PHP constants provided by the class Webauthn\PublicKeyCredentialCreationOptions:

  • ATTESTATION_CONVEYANCE_PREFERENCE_NONE: the Relying Party is not interested in authenticator attestation (default)
  • ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT: the Relying Party prefers an attestation conveyance yielding verifiable attestation statements, but allows the client to decide how to obtain such attestation statements.
  • ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT: the Relying Party wants to receive the attestation statement as generated by the authenticator.
  • ATTESTATION_CONVEYANCE_PREFERENCE_ENTERPRISE: the Relying Party wants to receive uniquely identifying information from authenticators.
config/packages/webauthn.yaml
webauthn:
    credential_repository: ...
    user_repository: ...
    creation_profiles:
        acme:
            attestation_conveyance: !php/const Webauthn\PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT
            rp:
                name: 'My application'
                id: 'example.com'