Server error codes

[Mykhailo-Sichkaruk]

Proposal

It would be great if server lib had codes for errors.
There are such error codes for frontend - #367 .

Consider example -

• you want to run some logic if counter is lower than expected,
• and you want to run another logic if origin mismathes
• else rethrow

I want to it to look like this in my code:

			try {
				const verification = await verifyAuthenticationResponse({
				...
				});
			} catch (error: WebAuthnError) {
			        if (error.code === 'COUNTER_TOO_LOW') {
			            // logout user
			            // delete passkey
			        } else if (error.code === 'ORIGIN_MISMATCH'){
			            throw new Error('I'm a teapot');
                                } else {
                                    throw error;
                                }
			}

Just say what do you think about it generally and we can start discussing implementation details.
I want to contribute.

---

P.S.: thank you for such great library

[MasterKale]

Hello @Mykhailo-Sichkaruk, thanks for the suggestion! This is a great idea, I see how it'd be nice to bring some order to the many more errors that @simplewebauthn/server might raise. I'll begin thinking about this and try to implement a custom error like @simplewebauthn/browser's WebAuthnError from #367 like you called out... 🤔

[Mykhailo-Sichkaruk]

Thanks for considering this feature 😊
I'm also thinking how we can improve error handling

I have a related idea: grouping errors to handle not just one error but set of related errors.

For example, a PublicKeyError category could group all public key-related issues, such as:

• PublicKeyMissingAlgError
• PublicKeyInvalidAlgError
• other

This could be implemented with inheritance:

class PublicKeyError extends WebAuthnError {}
class PublicKeyInvalidAlgError extends PublicKeyError {}

Or, alternatively, using a list of error codes:

const PublicKeyErrors = ['public_key_invalid_alg', 'public_key_missing_alg', ...];

This can help not only in handling errors, but also in understanding for users of the lib how errors relate to each other and how they should be handled.

[junderw]

Ran into this today, had to write some regex to match the message string passed into an error deep in this library.

Luckily it's open source, and I wrote some unit tests to check for regressions if I ever update and the message changes.

I noticed pull requests are locked. Would you be interested in taking a patch if I have some time to work on it?

[MasterKale]

Thanks for keeping this issue alive @junderw. I still think this is worth doing. I'm trying to get v14.0.0 out the door, but it's got enough features in it that I'm going to wait till after that goes out to begin working on this as a "v14.1.0" release.

I noticed pull requests are locked. Would you be interested in taking a patch if I have some time to work on it?

I appreciate the offer but will respectfully decline. I'm all ears for any proposals you might have for how to pull this off though. My game plan remains to add something like @simplewebauthn/browser's WebAuthnError into @simplewebauthn/server, with a code property that gets set to some enum string like ERROR_CEREMONY_ABORTED, etc... Then I'd update everything to consistently throw WebAuthnError.