Remove tokenBinding verification

CHANGELOG.md

@@ -6,6 +6,13 @@
 
 - Add support for crossOrigin/topOrigin verification during credential registration and authentication. [#486](https://github.com/cedarcode/webauthn-ruby/pull/486) [@nicolastemciuc]
 
+### Removed
+
+- Remove `TokenBinding` verification during credential registration and authentication. [#450](https://github.com/cedarcode/webauthn-ruby/pull/450) [@nicolastemciuc]
+  - BREAKING CHANGE: `WebAuthn::TokenBindingVerificationError` no longer exists. Remove it from any `rescue` clauses.
+  - BREAKING CHANGE: `WebAuthn::FakeClient.new` no longer accepts `token_binding:`.
+  - BREAKING CHANGE: `WebAuthn::ClientData` no longer exposes `#token_binding` or `#valid_token_binding_format?`.
+
 ## [v3.4.3](https://github.com/cedarcode/webauthn-ruby/compare/v3.4.2...v3.4.3/) - 2025-10-23
 
 ### Fixed

lib/webauthn/authenticator_response.rb

@@ -13,7 +13,6 @@ class AuthenticatorDataVerificationError < VerificationError; end
   class ChallengeVerificationError < VerificationError; end
   class OriginVerificationError < VerificationError; end
   class RpIdVerificationError < VerificationError; end
-  class TokenBindingVerificationError < VerificationError; end
   class TopOriginVerificationError < VerificationError; end
   class TypeVerificationError < VerificationError; end
   class UserPresenceVerificationError < VerificationError; end
@@ -31,7 +30,6 @@ def verify(expected_challenge, expected_origin = nil, user_presence: nil, user_v
       rp_id ||= relying_party.id
 
       verify_item(:type)
-      verify_item(:token_binding)
       verify_item(:challenge, expected_challenge)
       verify_item(:origin, expected_origin)
       verify_item(:top_origin) if needs_top_origin_verification?
@@ -82,10 +80,6 @@ def valid_type?
       client_data.type == type
     end
 
-    def valid_token_binding?
-      client_data.valid_token_binding_format?
-    end
-
     def valid_top_origin?
       return false unless client_data.cross_origin
 

lib/webauthn/client_data.rb

@@ -9,8 +9,6 @@ module WebAuthn
   class ClientDataMissingError < Error; end
 
   class ClientData
-    VALID_TOKEN_BINDING_STATUSES = ["present", "supported", "not-supported"].freeze
-
     def initialize(client_data_json)
       @client_data_json = client_data_json
     end
@@ -27,10 +25,6 @@ def origin
       data["origin"]
     end
 
-    def token_binding
-      data["tokenBinding"]
-    end
-
     def cross_origin
       data["crossOrigin"]
     end
@@ -39,14 +33,6 @@ def top_origin
       data["topOrigin"]
     end
 
-    def valid_token_binding_format?
-      if token_binding
-        token_binding.is_a?(Hash) && VALID_TOKEN_BINDING_STATUSES.include?(token_binding["status"])
-      else
-        true
-      end
-    end
-
     def hash
       OpenSSL::Digest::SHA256.digest(client_data_json)
     end

lib/webauthn/fake_client.rb

@@ -10,20 +10,18 @@ module WebAuthn
   class FakeClient
     TYPES = { create: "webauthn.create", get: "webauthn.get" }.freeze
 
-    attr_reader :origin, :cross_origin, :top_origin, :token_binding, :encoding
+    attr_reader :origin, :cross_origin, :top_origin, :encoding
 
     def initialize(
       origin = fake_origin,
       cross_origin: nil,
       top_origin: nil,
-      token_binding: nil,
       authenticator: WebAuthn::FakeAuthenticator.new,
       encoding: WebAuthn.configuration.encoding
     )
       @origin = origin
       @cross_origin = cross_origin
       @top_origin = top_origin
-      @token_binding = token_binding
       @authenticator = authenticator
       @encoding = encoding
     end
@@ -137,10 +135,6 @@ def data_json_for(method, challenge)
         origin: origin
       }
 
-      if token_binding
-        data[:tokenBinding] = token_binding
-      end
-
       if cross_origin
         data[:crossOrigin] = cross_origin
       end

spec/webauthn/authenticator_assertion_response_spec.rb

@@ -239,22 +239,6 @@
     end
   end
 
-  describe "tokenBinding validation" do
-    let(:client) { WebAuthn::FakeClient.new(actual_origin, token_binding: token_binding, encoding: false) }
-
-    context "it has stuff" do
-      let(:token_binding) { { status: "supported" } }
-
-      it_behaves_like "a valid assertion response"
-    end
-
-    context "has an invalid format" do
-      let(:token_binding) { "invalid token binding format" }
-
-      it_behaves_like "an invalid assertion response that raises", WebAuthn::TokenBindingVerificationError
-    end
-  end
-
   describe "rp_id validation" do
     before do
       WebAuthn.configuration.rp_id = "different-rp_id"

spec/webauthn/authenticator_attestation_response_spec.rb

@@ -617,26 +617,6 @@
     end
   end
 
-  describe "tokenBinding validation" do
-    let(:client) { WebAuthn::FakeClient.new(origin, token_binding: token_binding, encoding: false) }
-
-    before do
-      WebAuthn.configuration.allowed_origins = [origin]
-    end
-
-    context "it has stuff" do
-      let(:token_binding) { { status: "supported" } }
-
-      it_behaves_like "a valid attestation response"
-    end
-
-    context "has an invalid format" do
-      let(:token_binding) { "invalid token binding format" }
-
-      it_behaves_like "an invalid attestation response that raises", WebAuthn::TokenBindingVerificationError
-    end
-  end
-
   describe "top_origin validation" do
     let(:client) { WebAuthn::FakeClient.new(origin, encoding: false, cross_origin: cross_origin, top_origin: client_top_origin) }
     let(:top_origin) { fake_top_origin }