validateAssertion

Verifies an assertion over arbitrary client data, tied to a previously stored attestation.

referenceClientData must contain the exact, unhashed bytes whose SHA-256 digest the client passed to generateAssertion. App Attest assertions do not contain those bytes. Signature verification proves their integrity, while validator is responsible for parsing them and verifying that they contain expectedChallenge. The caller must obtain the expected challenge from trusted server-side state and enforce its expiry and single use.

The attestation is not verified again! There is no timeliness guarantee of any kind, so manually verify the freshness of the challenge before calling this function

A Note on Counters:
AppAttest only checks whether the signature counter is higher than the last seen counter*. That is, a value of 0L will always work. Warden Supreme also allows specifying how much the counter may at most have advanced since the lastSeenCounter (i.e. since the signaure count of the last seen valid assertion), hence maxCounterAdvance.

Example:

// calling for the very first time, an assertion is received:
with(validator) {
  validateAssertion(attestation, assertion, clientData, challenge,
    lastSeenCounter = 0L, //No signatures have been created
    maxCounterAdvance = 1L //Make sure that this is the first signature to be created
}

Context Parameters

Parameters