fido2

Version 2.1.0 (released 2026-01-14)

• CTAP 2.3 support:
  • Add new GetInfo fields: enc_cred_store_state.
  • Add support for pinComplexityPolicy extension.
  • Add thirdPartyPayment bit to credman.
  • Check support for config subcommands.
• WebAuthn:
  • Allow UserEntity without 'name' field for improved spec compliance.
  • Update MDS3 dataclasses with new fields.
• Fido2Client:
  • Fallback to PIN after UV_BLOCKED error.
  • Improve preflight handling when message exceeds maximum size.
• WindowsClient:
  • Fix: Parse 'credentialProtectionPolicy' properly.
  • Update win_api.py from latest webauthn.h.
  • Add support for hmac-secret-mc extension.
  • Add support for hints.
• Development:
  • Switch from Poetry to uv for project management.
  • Add pyright and ty for improved type checking.
  • Replace bandit and flake8 with ruff for linting.

Version 2.0.0 (released 2025-05-20)

• See also the migration guide: doc/Migration_1-2.adoc.
• Python 3.10 or later is now required.
• WebAuthn dataclasses have been updated to align with the WebAuthn Level 3 Working Draft. Constructors now require keyword arguments (kwargs_only=True), and serialization to/from dictionaries is compatible with standardized JSON formats.
• The features.webauthn_json_mapping flag has been removed, as its behavior (standardized JSON mapping) is now default.
• Fido2Client and WindowsClient constructors now accept a ClientDataCollector instance instead of origin and verify parameters.
• WindowsClient has been relocated to fido2.client.windows. Importing this class on non-Windows platforms will now raise an ImportError.
• Fido2Client methods now return RegistrationResponse and AuthenticationResponse objects, instead of raw attestation/assertion data.
• CTAP2/WebAuthn extension handling has been redesigned. Fido2Client now expects a list of Ctap2Extension instances. Default behavior includes extensions commonly supported by browsers.
• The fido2.cbor module's load_x and dump_x functions have been made private (renamed with a leading underscore) and should not be used directly.
• Previously deprecated functions and APIs have been removed.
• The __version__ attribute in fido2/__init__.py has been removed. Use importlib.metadata.version('fido2') to get the package version.
• Add support for Persistent PinUvAuthToken and encIdentifier.
• Add support for hmac-secret-mc and thirdPartyPayments exensions.
• Add new GetInfo fields based on CTAP 2.2
• Update COSE algorithnm types.
• Building the library now requires Poetry version 2.0 or later.

Version 2.0.0-beta.1 (released 2025-02-26) Preview release

Preview release: The API may undergo changes prior to the final 2.0.0 release!

• Require Python >= 3.10
• Building requires Poetry >= 2.0
• WebAuthn dataclasses have been updated to reflect the current state of the spec (level 3 working draft), constructors require arguments to be passed by name (kwargs_only), and serialization to/from dict is compatible with the standardized JSON formats.
• features.webauthn_json_mapping has been removed, as this behavior is now the standard.
• WindowsClient has been moved to fido2.client.windows. This class can no longer be imported on non-windows platforms (throws ImportError).
• Use RegistrationResponse and AuthenticationResponse classes as return values in Fido2Client.
• CTAP2/WebAuthn extension handling has been rewritten, Fido2Client now takes a list of Ctap2Extension instances. The default behavior is to include extensions which are generally supported by browsers.
• fido2.cbor load_x/dump_x functions have been made private, these should not be directly used.
• Removal of previously deprecated functions.
• Removal of __version__ in fido2/__init__.py (use importlib.metadata if needed).

Version 1.2.0 (released 2024-11-27)

• Improved extension handling: Several new extensions are now supported, both for Fido2Client and WindowsClient. Extension APIs have been redesigned, and old APIs have been deprecated, slated for removal in version 2.0.
  • Disable hmac-secret extension by default, preferring prf.
• Improved (de-)serialization of dataclasses to/from JSON-friendly dicts.
• Fido2Client:
  • Support allowCredentials/excludeCredentials of arbitrary length.
  • Handle PUAT_REQUIRED by re-attempting with PIN/UV.
• Allow localhost (and subdomains) to use http:// in RP ID verification by default.
• NFC: Support for Authenticators that return SW=61XX on SELECT.
• USB: Improve connection recovery and use more specific exceptions for errors.
• Fix: Handle residentKey=preferred properly.
• Fix: Handle Authentictors that do not pass extensions in GetInfo.

Version 1.1.3 (released 2024-03-13)

• Fix USB HID issue on MacOS that sometimes caused a pause while waiting for a timeout.
• Fix argument to CredProp extension where an enum value was required instead of also allowing a string.
• Fix parsing of some key types (ES384, ES512) causing signature verification to fail.
• Deprecation: Calling websafe_decode with a bytes argument instead of str. This will raise a TypeError in the next major version of the library.

Version 1.1.2 (released 2023-07-06)

• Fix ClientPin usage for Authenticators that do not support passing a PIN.
• Fix: Handle correct CTAP response codes in authenticatorSelection.

Version 1.1.1 (released 2023-04-05)

• Add community provided support for NetBSD.
• Bugfix: Don't set length for largeBlob when offset is 0.
• Bugfix: Remove print statement in webauthn parsing.

Version 1.1.0 (released 2022-10-17)

• Bugfix: Fix name of "crossOrigin" in CollectedClientData.create().
• Bugfix: Some incorrect type hints in the MDS3 classes were fixed.
• Stricter checking of dataclass field types.
• Add support for JSON-serialization of WebAuthn data classes. This changes the objects dict representation to align with new additions in the WebAuthn specification. As this may break compatibility, the new behavior requires explicit opt-in until python-fido2 2.0 is released.
• Update server example to use JSON serialization.
• Server: Add support for passing RegistrationResponse/AuthenticationResponse (or their deserialized JSON data) to register_complete/authenticate_complete.
• Add new "hybrid" AuthenticatorTransport.
• Add new AuthenticatorData flags, and use 2-letter names as in the WebAuthn spec (long names are still available as aliases).

Version 1.0.0 (released 2022-06-08)

• First stable release.

Version 1.0.0rc1 (released 2022-05-02)

• Release Candidate 1 of first stable release.
• Require Python 3.7 or later.
• APIs have updated to align with WebAuthn level 2.
• Several CTAP 2.1 features have been implemented.

Version 0.9.3 (released 2021-11-09)

• Bugfix: Linux - Don't fail device discovery when hidraw doesn't support HIDIOCGRAWUNIQ (Linux kernels before 5.6).

Version 0.9.2 (released 2021-10-14)

• Support the latest Windows webauthn.h API (included in Windows 11).
• Add product name and serial number to HidDescriptors.
• Remove the need for the uhid-freebsd dependency on FreeBSD.

Version 0.9.1 (released 2021-02-03)

• Add new CTAP error codes and improve handling of unknown codes.

WARNING: Backwards-incompatible changes!

Version 0.9.0 (released 2021-01-20)

• Server: Attestation is now done in two parts (to align better with the spec): First, type-specific validation is done to provide a trust chain. Second, validation of the trust chain is done.
• Client: API changes to better support extensions.
  • Fido2Client can be configured with Ctap2Extensions to support.
  • Client.make_credential now returns a AuthenticatorAttestationResponse, which holds the AttestationObject and ClientData, as well as any client extension results for the credential.
  • Client.get_assertion now returns an AssertionSelection object, which is used to select between multiple assertions, resulting in an AuthenticatorAssertionResponse, which holds the ClientData, assertion values, as well as any client extension results for the assertion.
• Renames: The CTAP1 and CTAP2 classes have been renamed to Ctap1 and Ctap2, respectively. The old names currently work, but will be removed in the future.
• ClientPin: The ClientPin API has been restructured to support multiple PIN protocols, UV tokens, and token permissions.
• CTAP 2.1 PRE: Several new features have been added for CTAP 2.1, including Credential Management, Bio Enrollment, Large Blobs, and Authenticator Config.
• HID: The platform specific HID code has been revamped and cleaned up.

WARNING: Backwards-incompatible changes!

Version 0.8.1 (released 2019-11-25)

• Bugfix: WindowsClient.make_credential error when resident key requirement is unspecified.

Version 0.8.0 (released 2019-11-25)

• New fido2.webauthn classes modeled after the W3C WebAuthn spec introduced.
• CTAP2 send_cbor/make_credential/get_assertion and U2fClient request/authenticate timeout arguments replaced with event used to cancel a request.
• Fido2Client:
• make_credential/get_assertion now take WebAuthn options objects.
• timeout is now provided in ms in WebAuthn options objects. Event based cancelation also available by passing an Event.
• Fido2Server:
• ATTESTATION, USER_VERIFICATION, and AUTHENTICATOR_ATTACHMENT enums have been replaced with fido2.webauthn classes.
• RelyingParty has been replaced with PublicKeyCredentialRpEntity, and name is no longer optional.
• Options returned by register_begin/authenticate_begin now omit unspecified values if they are optional, instead of filling in default values.
• Fido2Server.allowed_algorithms now contains a list of PublicKeyCredentialParameters instead of algorithm identifiers.
• Fido2Server.timeout is now in ms and of type int.
• Support native WebAuthn API on Windows through WindowsClient.

Version 0.7.3 (released 2019-10-24)

• Bugfix: Workaround for size of int on Python 2 on Windows.

Version 0.7.2 (released 2019-10-24)

• Support for the TPM attestation format.
• Allow passing custom challenges to register/authenticate in Fido2Server.
• Bugfix: CTAP2 CANCEL command response handling fixed.
• Bugfix: Fido2Client fix handling of empty allow_list.
• Bugfix: Fix typo in CTAP2.get_assertions() causing it to fail.

Version 0.7.1 (released 2019-09-20)

• Support for FreeBSD.
• Enforce canonical CBOR on Authenticator responses by default.
• PCSC: Support extended APDUs.
• Server: Verify that UP flag is set.
• U2FFido2Server: Implement AppID exclusion extension.
• U2FFido2Server: Allow custom U2F facet verification.
• Bugfix: U2FFido2Server.authenticate_complete now returns the result.

Version 0.7.0 (released 2019-06-17)

• Add support for NFC devices using PCSC.
• Add support for the hmac-secret Authenticator extension.
• Honor max credential ID length and number of credentials to Authenticator.
• Add close() method to CTAP devices to explicitly release their resources.

Version 0.6.0 (released 2019-05-10)

• Don't fail if CTAP2 Info contains unknown fields.
• Replace cbor loads/dumps functions with encode/decode/decode_from.
• Server: Add support for AuthenticatorAttachment.
• Server: Add support for more key algorithms.
• Client: Expose CTAP2 Info object as Fido2Client.info.

Version 0.5.0 (released 2018-12-21)

• Changes to server classes, some backwards breaking.
• Add ability to authenticate U2F credentials by using the appid extension.
• Make verification of attestation more explicit.
• Add support for Android SafetyNet attestation.
• Make it easier to work with U2F/CTAP1 data formats.

Version 0.4.0 (released 2018-09-27)

• Add classes for implementing a server.
• Various small changes, some affecting backwards compatibility.

Version 0.3.0 (released 2018-04-13)

• Add conversion between string/int keys for AttestationObject.
• Replace internal Exceptions with built-in types.
• Bugfix: Don't use TimeoutError which isn't available on Python 2.