Skip to content

Upgrading webauthn 1 to 2

Breaking1.11.1 → 2.8.0Breaking7Platform1New7Changed13Fixed5

Full comparisonBack to webauthn
BreakingUpgrade verdict

7 breaking changes and a platform requirement change.

In plain terms
  • The library no longer uses Pydantic internally, so code that relied on Pydantic methods on its objects needs updating.
  • The challenge helper now takes no parameters and always returns 64 random bytes.
  • The json_loads_base64url_to_bytes helper function is no longer available.
  • Code that parsed registration credentials with the old Pydantic method should call the new helper function instead.
Must act Top 4 of 8 that need code or config changes

Requires Python >=3.10 from 2.8.0 (none stated before).

Adds pyasn1 >=0.6.2, pyasn1-modules >=0.4.2.

Drops asn1crypto, pydantic.

Installs 7 packages in all (was 11).

No longer installs annotated-types, pydantic-core, typing-extensions, typing-inspection.

Moves cbor2 6.1.5 → 5.9.0. Your build may pick other versions.

What you must change

Breaking7
Removes Pydantic as a dependency; Pydantic-specific method calls on py_webauthn classes must be refactored.
2.0.0GitHub ReleaseSummarizedView source
generate_challenge() now always generates 64 random bytes and no longer accepts arguments.
webauthn.helpers.generate_challenge()
2.0.0GitHub ReleaseSummarizedView source
Removes webauthn.helpers.json_loads_base64url_to_bytes().
webauthn.helpers.json_loads_base64url_to_bytes()
2.0.0GitHub ReleaseSummarizedView source
Replaces RegistrationCredential.parse_raw() with webauthn.helpers.parse_registration_credential_json().
RegistrationCredential.parse_raw()webauthn.helpers.parse_registration_credential_json()
2.0.0GitHub ReleaseSummarizedView source
Replaces AuthenticationCredential.parse_raw() with webauthn.helpers.parse_authentication_credential_json().
AuthenticationCredential.parse_raw()webauthn.helpers.parse_authentication_credential_json()
2.0.0GitHub ReleaseSummarizedView source
Replaces InvalidClientDataJSONStructure with InvalidJSONStructure.
webauthn.helpers.exceptions.InvalidClientDataJSONStructurewebauthn.helpers.exceptions.InvalidJSONStructure
2.0.0GitHub ReleaseSummarizedView source
generate_registration_options() user_id is now Optional[bytes] instead of required str; 64 random bytes are generated when None.
generate_registration_options()user_id
2.0.0GitHub ReleaseSummarizedView source
Platform1
Raises the minimum supported Python version to 3.9, with testing from Python 3.9 through 3.13.
2.3.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Python source. Not mixed with prose notes.

  • changed: class VerifiedAuthentication(WebAuthnBaseModel) → class VerifiedAuthentication
  • changed: function verify_authentication_response(*, credential: Union[str, dict, AuthenticationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], credential_public_key: bytes, credential_current_sign_count: int, require_user_verification: bool=…) -> VerifiedAuthentication → function verify_authentication_response(*, credential: Union[str, Dict[str, Any], AuthenticationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], credential_public_key: bytes, credential_current_sign_count: int, require_user_verification: bool=…) -> VerifiedAuthentication
  • added: field VerifiedAuthentication.user_verified: bool
  • removed: export json_loads_base64url_to_bytes
  • added: export byteslike_to_bytes
  • added: export encode_cbor
  • added: export options_to_json_dict
  • added: export parse_authentication_options_json
  • added: export parse_registration_options_json
  • added: field AuthorizationList.componentType
  • added: field Integers.componentType
  • added: field KeyDescription.componentType
  • added: field RootOfTrust.componentType
  • added: field SecurityLevel.namedValues
  • added: field VerifiedBootState.namedValues
  • added: function byteslike_to_bytes(val: Union[bytes, memoryview]) -> bytes
  • changed: class DecodedEC2PublicKey(BaseModel) → class DecodedEC2PublicKey
  • changed: class DecodedOKPPublicKey(BaseModel) → class DecodedOKPPublicKey
  • changed: class DecodedRSAPublicKey(BaseModel) → class DecodedRSAPublicKey
  • added: function encode_cbor(val: Any) -> bytes
  • removed: class InvalidClientDataJSONStructure(Exception)
  • changed: class InvalidAuthenticationResponse(Exception) → class InvalidAuthenticationResponse(WebAuthnException)
  • changed: class InvalidAuthenticatorDataStructure(Exception) → class InvalidAuthenticatorDataStructure(WebAuthnException)
  • changed: class InvalidBackupFlags(Exception) → class InvalidBackupFlags(WebAuthnException)
  • changed: class InvalidCBORData(Exception) → class InvalidCBORData(WebAuthnException)
  • changed: class InvalidCertificateChain(Exception) → class InvalidCertificateChain(WebAuthnException)
  • changed: class InvalidPublicKeyStructure(Exception) → class InvalidPublicKeyStructure(WebAuthnException)
  • changed: class InvalidRegistrationResponse(Exception) → class InvalidRegistrationResponse(WebAuthnException)
  • changed: class InvalidTPMCertInfoStructure(Exception) → class InvalidTPMCertInfoStructure(WebAuthnException)
  • changed: class InvalidTPMPubAreaStructure(Exception) → class InvalidTPMPubAreaStructure(WebAuthnException)
  • changed: class SignatureVerificationException(Exception) → class SignatureVerificationException(WebAuthnException)
  • changed: class UnsupportedAlgorithm(Exception) → class UnsupportedAlgorithm(WebAuthnException)
  • changed: class UnsupportedEC2Curve(Exception) → class UnsupportedEC2Curve(WebAuthnException)
  • changed: class UnsupportedPublicKey(Exception) → class UnsupportedPublicKey(WebAuthnException)
  • changed: class UnsupportedPublicKeyType(Exception) → class UnsupportedPublicKeyType(WebAuthnException)
  • added: class InvalidAttestationObjectStructure(WebAuthnException)
  • added: class InvalidAuthenticationOptions(WebAuthnException)
  • added: class InvalidJSONStructure(WebAuthnException)
  • added: class InvalidRegistrationOptions(WebAuthnException)
  • added: class WebAuthnException(Exception)
  • changed: function generate_challenge(length: int=…) -> bytes → function generate_challenge() -> bytes
  • removed: function json_loads_base64url_to_bytes(input: Union[str, bytes]) -> Any
  • removed: variable globalsign_r2
  • removed: variable google_hardware_attestation_root_1
  • added: variable google_hardware_attestation_root_3
  • added: variable google_hardware_attestation_root_4
  • added: variable google_hardware_attestation_root_5
  • added: function options_to_json_dict(options: Union[PublicKeyCredentialCreationOptions, PublicKeyCredentialRequestOptions], bytes_encoder: Callable[[bytes], Any]=…) -> Dict[str, Any]
  • changed: function parse_attestation_statement(val: dict) -> AttestationStatement → function parse_attestation_statement(val: Dict[str, Any]) -> AttestationStatement
  • changed: function parse_authentication_credential_json(json_val: Union[str, dict]) -> AuthenticationCredential → function parse_authentication_credential_json(json_val: Union[str, Dict[str, Any]]) -> AuthenticationCredential
  • added: function parse_authentication_options_json(json_val: Union[str, Dict[str, Any]]) -> PublicKeyCredentialRequestOptions
  • changed: class ParsedBackupFlags(BaseModel) → class ParsedBackupFlags
  • changed: function parse_registration_credential_json(json_val: Union[str, dict]) -> RegistrationCredential → function parse_registration_credential_json(json_val: Union[str, Dict[str, Any]]) -> RegistrationCredential
  • added: function parse_registration_options_json(json_val: Union[str, Dict[str, Any]]) -> PublicKeyCredentialCreationOptions
  • removed: class WebAuthnBaseModel(BaseModel)
  • removed: class WebAuthnBaseModel.Config
  • removed: field WebAuthnBaseModel.Config.alias_generator
  • removed: field WebAuthnBaseModel.Config.allow_population_by_field_name
  • removed: field WebAuthnBaseModel.Config.json_encoders
  • removed: field WebAuthnBaseModel.Config.json_loads
  • removed: field WebAuthnBaseModel.model_config
  • removed: variable PYDANTIC_V2
  • changed: class AttestationObject(WebAuthnBaseModel) → class AttestationObject
  • changed: class AttestationStatement(WebAuthnBaseModel) → class AttestationStatement
  • changed: class AttestedCredentialData(WebAuthnBaseModel) → class AttestedCredentialData
  • changed: class AuthenticationCredential(WebAuthnBaseModel) → class AuthenticationCredential
  • changed: class AuthenticatorAssertionResponse(WebAuthnBaseModel) → class AuthenticatorAssertionResponse
  • changed: class AuthenticatorAttestationResponse(WebAuthnBaseModel) → class AuthenticatorAttestationResponse
  • changed: class AuthenticatorData(WebAuthnBaseModel) → class AuthenticatorData
  • changed: class AuthenticatorDataFlags(WebAuthnBaseModel) → class AuthenticatorDataFlags
  • changed: class AuthenticatorSelectionCriteria(WebAuthnBaseModel) → class AuthenticatorSelectionCriteria
  • changed: class CollectedClientData(WebAuthnBaseModel) → class CollectedClientData
  • changed: class PublicKeyCredentialCreationOptions(WebAuthnBaseModel) → class PublicKeyCredentialCreationOptions
  • changed: class PublicKeyCredentialDescriptor(WebAuthnBaseModel) → class PublicKeyCredentialDescriptor
  • changed: class PublicKeyCredentialParameters(WebAuthnBaseModel) → class PublicKeyCredentialParameters
  • changed: class PublicKeyCredentialRequestOptions(WebAuthnBaseModel) → class PublicKeyCredentialRequestOptions
  • changed: class PublicKeyCredentialRpEntity(WebAuthnBaseModel) → class PublicKeyCredentialRpEntity
  • changed: class PublicKeyCredentialUserEntity(WebAuthnBaseModel) → class PublicKeyCredentialUserEntity
  • changed: class RegistrationCredential(WebAuthnBaseModel) → class RegistrationCredential
  • changed: class TokenBinding(WebAuthnBaseModel) → class TokenBinding
  • added: class PublicKeyCredentialHint(str, Enum)
  • added: field AuthenticatorTransport.SMART_CARD
  • added: field PublicKeyCredentialCreationOptions.hints: Optional[List[PublicKeyCredentialHint]]
  • added: field PublicKeyCredentialHint.CLIENT_DEVICE
  • added: field PublicKeyCredentialHint.HYBRID
  • added: field PublicKeyCredentialHint.SECURITY_KEY
  • added: export map_tpm_manufacturer_id
  • added: function map_tpm_manufacturer_id(id: str) -> TPMManufacturerInfo
  • changed: function verify_signature(*, public_key: Union[EllipticCurvePublicKey, RSAPublicKey, Ed25519PublicKey, DSAPublicKey, Ed448PublicKey, X25519PublicKey, X448PublicKey], signature_alg: COSEAlgorithmIdentifier, signature: bytes, data: bytes) -> None → function verify_signature(*, public_key: CertificatePublicKeyTypes, signature_alg: COSEAlgorithmIdentifier, signature: bytes, data: bytes) -> None
  • changed: class SafetyNetJWSHeader(WebAuthnBaseModel) → class SafetyNetJWSHeader
  • changed: class SafetyNetJWSPayload(WebAuthnBaseModel) → class SafetyNetJWSPayload
  • changed: function generate_registration_options(*, rp_id: str, rp_name: str, user_id: str, user_name: str, user_display_name: Optional[str]=…, challenge: Optional[bytes]=…, timeout: int=…, attestation: AttestationConveyancePreference=…, authenticator_selection: Optional[AuthenticatorSelectionCriteria]=…, exclude_credentials: Optional[List[PublicKeyCredentialDescriptor]]=…, supported_pub_key_algs: Optional… → function generate_registration_options(*, rp_id: str, rp_name: str, user_name: str, user_id: Optional[bytes]=…, user_display_name: Optional[str]=…, challenge: Optional[bytes]=…, timeout: int=…, attestation: AttestationConveyancePreference=…, authenticator_selection: Optional[AuthenticatorSelectionCriteria]=…, exclude_credentials: Optional[List[PublicKeyCredentialDescriptor]]=…, supported_pub_key_…
  • changed: class VerifiedRegistration(WebAuthnBaseModel) → class VerifiedRegistration
  • changed: function verify_registration_response(*, credential: Union[str, dict, RegistrationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], require_user_verification: bool=…, supported_pub_key_algs: List[COSEAlgorithmIdentifier]=…, pem_root_certs_bytes_by_fmt: Optional[Mapping[AttestationFormat, List[bytes]]]=…) -> VerifiedRegistration → function verify_registration_response(*, credential: Union[str, Dict[str, Any], RegistrationCredential], expected_challenge: bytes, expected_rp_id: str, expected_origin: Union[str, List[str]], require_user_presence: bool=…, require_user_verification: bool=…, supported_pub_key_algs: List[COSEAlgorithmIdentifier]=…, pem_root_certs_bytes_by_fmt: Optional[Mapping[AttestationFormat, List[bytes]]]=…) -…