PublicKeyCredentialCreationOptions.extensions

Secure context
This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.

extensions, an optional property of the PublicKeyCredentialCreationOptions dictionary, is an object providing the client extensions and their input values.

Extensions are values requesting additional processing by the client and by the authenticator. For instance, extensions may be used for:

backward compatibility with the legacy FIDO JS API,
knowing the user verification process,
etc.

Note: An analogous option exists for the fetching operation (navigators.credentials.get()), see PublicKeyCredentialRequestOptions.extensions.

Syntax

extensions = publicKeyCredentialCreationOptions.extensions

Value

An object with various keys and values.

Here is the current (as of March 2019) list of potential extensions which may be used during the registration operation.

Warning! As of March 2019, only appId (used during creation with PublicKeyCredentialRequestOptions.extensions) is supported by Chrome and Edge. Firefox does not seem to support any extension.

Extension identifier	Type	Description
`authnSel`	Array of `BufferSource`	Authenticator selection. Restricts the list of authenticator models which may be used. If no matching authenticator is available, the credential is still generated with another available authenticator.
`exts`	Boolean	Supported extensions. If `true`, the client outputs an array of strings containing the extensions which are supported by the authenticator.
`uvi`	Boolean	User verification index. If `true`, the client outputs an `ArrayBuffer` which contains a value uniquely identifying a user verification data record. In other words, this may be used server side to check if the current operation is based on the same biometric data that the previous authentication.
`loc`	Boolean	Location. If `true`, the client outputs a `Coordinates` object representing the geolocation of the authenticator.
`uvm`	Boolean	User verification method. If `true`, the client outputs an array of arrays with 3 values containing information about how the user was verified (e.g. fingerprint, pin, pattern), how the key is protected, how the matcher (tool used for the authentication operation) is protected.
`biometricPerfBounds`	Object with two numerical properties: `FAR` and `FRR`	Biometric authenticator performance bounds. The client must not use any authenticator with false acceptance rate (FAR) and false rejection rate (FRR) below the inputs. The client outputs `true` if this was taken into account.

Note: Extensions are optional and different browsers may recognize different extensions. All extensions are optional for the client to process them: if a browser does not know a given extension, that will not cause any failure, the extension simply will not be processed.

Examples

var publicKey = {
  extensions:{
    uvi: true,
    loc: false,
    uvm: false,
    exts: true
  },
  challenge: new Uint8Array(26) /* this actually is given from the server */,
  rp: {
    name: "Example CORP",
    id  : "login.example.com"
  },
  user: {
    id: new Uint8Array(26), /* To be changed for each user */
    name: "jdoe@example.com",
    displayName: "John Doe",
  },
  pubKeyCredParams: [ {
    type: "public-key",
    alg: -7 } ]
};

navigator.credentials.create({ publicKey })
  .then(function (newCredentialInfo) {
    // myBuffer will contain the result of any of the processing of the extensions
    var myBuffer = newCredentialInfo.getClientExtensionResults(); 

    // send attestation response and client extensions
    // to the server to proceed with the registration
    // of the credential
  }).catch(function (err) {
     console.error(err);
  });

Specifications

Specification	Status	Comment
Web Authentication: An API for accessing Public Key Credentials Level 1 The definition of 'extensions' in that specification.	Candidate Recommendation	Initial definition.

Browser compatibility

Update compatibility data on GitHub

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`extensions` Experimental	Chrome Full support 67	Edge ?	Firefox Full support 60	IE ?	Opera ?	Safari ?	WebView Android No support No	Chrome Android Full support 67	Firefox Android ?	Opera Android ?	Safari iOS ?	Samsung Internet Android Full support 9.0

Legend

Full support: Full support
No support: No support
Compatibility unknown: Compatibility unknown
Experimental. Expect behavior to change in the future.: Experimental. Expect behavior to change in the future.