Struct WebauthnConfig 

pub struct WebauthnConfig {
    pub rp_id: String,
    pub rp_name: String,
    pub rp_origins: Vec<String>,
    pub allowed_algorithms: Vec<i32>,
    pub challenge_timeout_secs: u64,
    pub attestation: AttestationPolicy,
    pub credential_policy: CredentialPolicy,
    pub resident_key: ResidentKeyPolicy,
    pub attestation_conveyance: AttestationConveyance,
}

WebAuthn relying party configuration.

This is the kit-local replacement for any application-specific auth config struct: it carries everything the protocol layer needs and nothing else. Application concerns (feature flags, storage, session handling) are deliberately excluded.

Security notes

• rp_id must be the registrable domain suffix shared by all origins that may perform WebAuthn ceremonies. It is hashed (SHA-256) and compared against the rpIdHash embedded in authenticator data; a wrong value fails every verification.
• Every entry in rp_origins is an exact-match allow-list entry. Origins are compared byte-for-byte against clientDataJSON.origin; scheme, host, and port must all match. List only origins you fully trust.
• allowed_algorithms controls which COSE algorithms are advertised to authenticators in registration options. Runtime verification implements ES256 (-7), ES384 (-35), EdDSA (-8), and RS256 (-257); anything else is rejected with crate::WebauthnError::UnsupportedAlgorithm regardless of this setting. For server-side enforcement of the advertised set (rejecting credentials with other algorithms), set credential_policy.allowed_algorithms — advertising alone is not enforcement.
• attestation governs attestation statement verification during registration; see AttestationPolicy for the trust implications of empty trust_anchors and allow_unknown_formats.
• credential_policy is enforced server-side by crate::verify_registration / crate::verify_authentication; the resident_key / attestation_conveyance / advertised-algorithm settings are preferences conveyed to the client and cannot be relied on for enforcement.

Fields

rp_id: String

Relying party ID (effective domain, e.g. "example.com").

Must NOT include scheme or port. See struct-level security notes.

rp_name: String

Human-readable relying party name (advertised in registration options).

rp_origins: Vec<String>

Allowed origins for WebAuthn ceremonies (exact match, e.g. "https://example.com").

allowed_algorithms: Vec<i32>

COSE algorithm identifiers advertised for registration.

Defaults to [-7 (ES256), -35 (ES384), -257 (RS256)].

challenge_timeout_secs: u64

Challenge freshness window in seconds (default 300 = 5 minutes).

Challenges older than this are rejected on consumption.

attestation: AttestationPolicy

Attestation verification policy applied by crate::verify_registration (default: strict — unknown formats rejected, no trust anchors configured).

credential_policy: CredentialPolicy

Server-side credential policy enforced during both ceremonies (default: permissive — UV reported, syncable credentials allowed, no algorithm allowlist). See CredentialPolicy.

resident_key: ResidentKeyPolicy

Discoverable-credential preference conveyed in registration options (default: ResidentKeyPolicy::Preferred).

attestation_conveyance: AttestationConveyance

Attestation conveyance preference conveyed in registration options (default: AttestationConveyance::None).

Trait Implementations

impl Clone for WebauthnConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WebauthnConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WebauthnConfig

fn default() -> Self

Sensible development defaults (localhost RP).

Do not use Default::default() in production; set rp_id and rp_origins to your real domain and HTTPS origin.