clientDataJSON

clientDataJSON is a component of the Web Authentication (WebAuthn) protocol. It represents the client-side data that describes a credential creation or assertion ceremony, and its content is transmitted as part of the authenticator's response. The data is produced by the browser, encoded as a JSON object, converted to UTF-8 bytes, and then base64url-encoded to form the clientDataJSON value included in the response.

The JSON object contained in clientDataJSON typically includes several fields. The type field indicates the operation, such as "webauthn.create" for registration or "webauthn.get" for authentication. The challenge field carries the base64url-encoded challenge that the relying party issued. The origin field specifies the origin (scheme, host, and port) of the relying party. An optional tokenBinding object may be present, describing the status of token binding and, if applicable, the binding identifier.

During verification, the relying party decodes clientDataJSON from base64url, parses the JSON, and validates its contents. It checks that the origin matches its own origin and that the challenge corresponds to the challenge it issued, helping to prevent replay and origin-confusion attacks. The tokenBinding information informs about TLS token binding usage, which can affect trust decisions in certain deployments.

In the overall WebAuthn flow, clientDataJSON is used alongside other data produced during the ceremony, such as authenticatorData and signatures, to establish a secure, bound authentication event. Its integrity and proper validation are essential for maintaining the security guarantees of WebAuthn.