juice-safe-v6 WebAuthn review: one assertion authorizes three operations
A caller-controlled clientDataJSON split checks challenge inclusion rather than equality, allowing one genuine passkey assertion to validate three distinct operation hashes.
A caller-controlled clientDataJSON split checks challenge inclusion rather than equality, allowing one genuine passkey assertion to validate three distinct operation hashes.