Thales challenge token extension

The Thales challenge token extension is used to convey contextual information about the attestation or assertion. Its contents are opaque for applications. When it is present in the attestation or assertion options, it has to be passed back in the corresponding result response.

This extension is automatically activated.

Using web APIs

The application receives from the FIDO server a challenge token extension in the server attestation or assertion options response.

{
  ...
  "extensions": {
    "thalesgroup_chl_tkn_ext_v1": {
        ... // some object structure generated by the server side
    }
  },
  ...
}

After the execution of the WebAuthn client operation, the web application must place the same challenge token extension value in the attestation or assertion result request body:

{
  ...
  "clientExtensionResults": {
    "thalesgroup_chl_tkn_ext_v1": {
        ... // the same object value that was received through the server attestation or assertion options
    }
  },
  ...
}