Those of you who have been reading my recent series of blog posts will realize that I’ve been spending a great deal of time working on FIDO2 and WebAuthn related technologies. As part of this effort which has been in progress on and off for more than 12 months now, I put together a debugging utility that unpacks the common WebAuthn data structures that are passed between the browser and a WebAuthn relying party – such as ISAM which I’ve blogged about in my last few articles.

As a give-back to the general FIDO2 and WebAuthn development community I have released this debugging utility as open source – available on github.com here:

https://github.com/sbweeden/fido2viewer

The readme contained in the repository goes over all the basic usage of the tool. The tool runs entirely in client-side javascript, so no, I won’t be capturing any of your message data! It contains a couple of embedded test payloads that I’ve captured from interactions with IBM’s access management demonstration site (https://verify.securitypoc.com), however I know that these same payload formats are in common use with other WebAuthn relying parties as well.

So, who would use this tool, and why?

The primary target audience is other developers and educators working on FIDO-enabled systems (both IBM’ers and in general), our support team, and interested customers and business partners that really want to understand a little more about the detailed contents of message payloads that are generated (via the browser) on FIDO authenticators and are then sent to relying parties for either registration (attestation) or login (assertion) processing and validation.

When used in conjunction with the WebAuthn specification, and other Introduction to Web Authentication sites and articles, I hope the fido2viewer debugging utility will allow interested persons to quickly and easily understand what the underlying data elements of FIDO messages actually look like, and aid in debugging issues with FIDO-enabled systems. It has certainly been of help to me as we at IBM have been building out our own relying party systems!