What information does FIDO2 url contain and how can we decode it in Swift?

Question

letsbondiway1986 OP

Created Aug ’22

Replies 1

Boosts 0

Views 1.3k

Participants 2

0

In WWDC 2022 Apple launched GA of Passkeys which will enable FIDO2 authentication in iOS ecosystem, the next gen open standards based authentication mechanism to replace passwords.

On a Relying Party (RP) server supporting FIDO2 when a user registration is initiated, the browser generates a QR code to register a phone as platform authenticator.

I am trying to build an app which opens up a QR scanner view and I want to register for the FIDO credential from the app by scanning the QR code generated by the browser. The parsed string is of the format - FIDO:/090409094349049349.......

What information does this FIDO:/090409094349049349....... url protocol contain relating to the RP? Also, is there a way to decode this in Swift to get that information in json or string format?

Since the camera app on iPhone is able to scan the QR and generate information like RP domain name and user being registered, I believe there should be a way to do this from a QR scanner inside an app as well. Or are these APIs private in nature only for usage of Camera app?

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’22

The contents and encoding of the QR code, and the details of the subsequent Bluetooth and network connections that it bootstraps, are scheduled for the CTAP2.2 spec. However, apps don't need to do anything to support cross-device sign in. The browser or OS will take care of both generating the QR code (on the Client side) and of scanning/handling them (on the Authenticator side). All of this comes for free as part of adopting passkeys.

0