Enum UserVerificationPolicy 

pub enum UserVerificationPolicy {
    Required,
    Preferred,
    Discouraged_DO_NOT_USE,
}

Defines the User Authenticator Verification policy. This is documented https://w3c.github.io/webauthn/#enumdef-userverificationrequirement, and each variant lists it’s effects.

To be clear, Verification means that the Authenticator perform extra or supplementary interaction with the user to verify who they are. An example of this is Apple Touch Id required a fingerprint to be verified, or a yubico device requiring a pin in addition to a touch event.

An example of a non-verified interaction is a yubico device with no pin where touch is the only interaction - we only verify a user is present, but we don’t have extra details to the legitimacy of that user.

As UserVerificationPolicy is only used in credential registration, this stores the verification state of the credential in the persisted credential. These persisted credentials define which UserVerificationPolicy is issued during authentications.

IMPORTANT - Due to limitations of the webauthn specification, CTAP devices, and browser implementations, the only secure choice as an RP is required.

⚠️ WARNING - discouraged is marked with a warning, as some authenticators will FORCE verification during registration but NOT during authentication. This makes it impossible for a relying party to consistently enforce user verification, which can confuse users and lead them to distrust user verification is being enforced.

⚠️ WARNING - preferred can lead to authentication errors in some cases due to browser peripheral exchange allowing authentication verification bypass. Webauthn RS is not vulnerable to these bypasses due to our tracking of UV during registration through authentication, however preferred can cause legitimate credentials to not prompt for UV correctly due to browser perhipheral exchange leading Webauthn RS to deny them in what should otherwise be legitimate operations.

Variants

Required

Require user verification bit to be set, and fail the registration or authentication if false. If the authenticator is not able to perform verification, it will not be usable with this policy.

This policy is the default as it is the only secure and consistent user verification option.

Preferred

Prefer UV if possible, but ignore if not present. In other webauthn deployments this is bypassable as it implies the library will not check UV is set correctly for this credential. Webauthn-RS is not vulnerable to this as we check the UV state always based on it’s presence at registration.

However, in some cases use of this policy can lead to some credentials failing to verify correctly due to browser peripheral exchange bypasses.

Discouraged_DO_NOT_USE

Discourage - but do not prevent - user verification from being supplied. Many CTAP devices will attempt UV during registration but not authentication leading to user confusion.

Trait Implementations

impl Clone for UserVerificationPolicy

fn clone(&self) -> UserVerificationPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for UserVerificationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for UserVerificationPolicy

fn default() -> UserVerificationPolicy

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for UserVerificationPolicy

fn deserialize<__D>( __deserializer: __D, ) -> Result<UserVerificationPolicy, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Ord for UserVerificationPolicy

fn cmp(&self, other: &UserVerificationPolicy) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for UserVerificationPolicy

fn eq(&self, other: &UserVerificationPolicy) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for UserVerificationPolicy

fn partial_cmp(&self, other: &UserVerificationPolicy) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for UserVerificationPolicy

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for UserVerificationPolicy

impl Eq for UserVerificationPolicy

impl StructuralPartialEq for UserVerificationPolicy