Enum WebAuthnError 

pub enum WebAuthnError {
    InvalidClientData(String),
    ChallengeMismatch,
    OriginMismatch {
        expected: String,
        got: String,
    },
    RpIdHashMismatch,
    UserNotPresent,
    UserNotVerified,
    InvalidAttestationObject(String),
    InvalidAuthenticatorData(String),
    InvalidPublicKey(String),
    SignatureVerificationFailed,
    SignCountInvalid {
        stored: u32,
        received: u32,
    },
    CborDecodeError(String),
    Base64DecodeError(String),
    ChallengeExpired,
    ChallengePreviouslyUsed,
    UnsupportedAlgorithm(i64),
    CrossOriginNotAllowed,
    BackupEligibleNotAllowed,
    BackupEligibilityRequired,
    BackupEligibilityChanged,
    AttestationChainInvalid(String),
    AttestationRootUntrusted,
}

All errors that can be returned by WebAuthn ceremony verification.

Variants

InvalidClientData(String)

The client data JSON could not be decoded or is structurally invalid.

ChallengeMismatch

The challenge inside the client data does not match the issued challenge.

Security-critical: a mismatch means the response was not produced for this ceremony instance.

OriginMismatch

The origin field in the client data does not match the expected origin.

Prevents a credential from one origin being replayed at another.

Fields

expected: String

got: String

RpIdHashMismatch

The RP ID hash in authenticator data does not equal SHA-256(rp_id).

Ensures the authenticator bound the credential to the correct relying party.

UserNotPresent

The User Present (UP) flag is not set in the authenticator data flags byte.

UserNotVerified

The User Verification (UV) flag is not set, but the relying party has require_user_verification enabled.

The authenticator must perform user verification (PIN, biometric, etc.) before the assertion is accepted.

InvalidAttestationObject(String)

The attestation object could not be decoded or is missing required fields.

InvalidAuthenticatorData(String)

The authenticator data bytes are malformed or too short.

InvalidPublicKey(String)

The COSE public key inside the credential data is invalid.

SignatureVerificationFailed

ECDSA signature verification returned a failure.

The message was either tampered with or signed by the wrong key.

SignCountInvalid

The sign count in the assertion is not greater than the stored sign count.

Indicates a possible authenticator clone or replay attack.

Fields

stored: u32

received: u32

CborDecodeError(String)

A CBOR decoding step failed.

Base64DecodeError(String)

A base64url decoding step failed.

ChallengeExpired

The challenge was issued too long ago and is no longer valid.

Callers should generate a new challenge and restart the ceremony.

ChallengePreviouslyUsed

The challenge has already been consumed by a previous ceremony.

This error is only returned when the relying party has opted in to single-use challenge enforcement via crate::RelyingParty::enforce_single_use_challenges. Issue a fresh challenge and restart the ceremony.

UnsupportedAlgorithm(i64)

The COSE algorithm identifier is not supported by this library.

The i64 is the raw COSE algorithm integer (e.g. -7 = ES256, -257 = RS256).

CrossOriginNotAllowed

clientDataJSON contains crossOrigin: true but the relying party has reject_cross_origin enabled.

Cross-origin credentials allow assertions from an iframe whose origin differs from the top-level origin. When the RP does not expect embedded usage, crossOrigin: true may indicate credential abuse.

BackupEligibleNotAllowed

The credential has the Backup Eligibility (BE) flag set, but this relying party has reject_backup_eligible enabled.

Use this policy when your threat model requires hardware-bound keys that cannot be synced to a cloud or platform account.

BackupEligibilityRequired

The credential does not have the Backup Eligibility (BE) flag set, but this relying party has require_backup_eligible enabled.

Use this policy for consumer passkey deployments that depend on credential sync (e.g. cross-device sign-in via iCloud Keychain or Google Password Manager).

BackupEligibilityChanged

The Backup Eligibility (BE) flag in the authenticator data differs from the value recorded at registration time.

BE is immutable per spec — a mismatch indicates a possible credential substitution attack (a different authenticator presenting the same credential ID).

AttestationChainInvalid(String)

The x5c certificate chain in an attestation statement is structurally invalid: a certificate in the chain is not signed by the next certificate, or the DER encoding is malformed.

The inner string identifies which link in the chain failed and why.

AttestationRootUntrusted

The x5c chain is structurally valid but its root certificate is not signed by any of the configured trust anchors.

This error is only returned when the relying party has configured at least one trust anchor via crate::RelyingParty::trust_anchors. When no trust anchors are configured the chain structure is still verified but the root is accepted unconditionally.

Trait Implementations

impl Debug for WebAuthnError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for WebAuthnError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for WebAuthnError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.