diff --git a/docs/en/pact-reference.md b/docs/en/pact-reference.md index 86e2f70cc..acc274c4e 100644 --- a/docs/en/pact-reference.md +++ b/docs/en/pact-reference.md @@ -243,6 +243,33 @@ signers: type: exec ``` +### WebAuthn Signature Format + +The Pact REST API can accept transactions signed by the WebAuthn protocol. + +A web client can use this scheme for authenticating and +signing Pact transactions without manually managing private keys. The client must: + + - Modify the `Signer`, it must have `scheme` set to `"WebAuthn"`. + - Construct the challenge as: `base64( blake2b ( CommandPayload ))` + - Issue a JavaScript `navigator.credentials.get` with this challenge. + - Construct a `Signature` from the credentials response. + - Prefix any public keys generated by the WebAuthn client with `"WEBAUTHN-"`, + both in the `signers` field and in any keys supplied via env data. + +The `"signature"` to pass to Pact (in the `"sigs"` field) is a stringified JSON +object composed of pieces taken from the browser's credential response, (the +`response` object, below). Some of the response fields must be converted from +the Base64URL alphabet to Base64: + +``` +{ + "signature": toBase64(response.signature), + "authenticatorData": toBase64(response.authenticatorData), + "clientDataJSON": toBase64URL(response.clientDataJSON) +} +``` + Concepts {#concepts} ========