Feature proposal: use a custom function to validate the challenge in verifyAuthenticationResponse

It’d be useful to provide a custom challenge validation function instead of the raw expectedChallenge

type ChallengeValidator = (challenge: string) => boolean;

Why: the challenge is the only arbitrary data that is signed with WebAuthn. Its content looks like this in my case:

base64url(JSON.stringify({
  "actualChallenge": "<big random value>",
  "arbitraryDataThatMustBeSignedForOtherPurposes": {
    "data1": "....",
  }
}))

Only actualChallenge is stored and used as a nonce, and needs to be verified

[MasterKale]

@antogyn I’m happy to report that I’ve just published @simplewebauthn/server@4.4.0 with support for arbitrary data signing during authentication as well. Please see CHANGELOG.md for more info.

[MasterKale]

@antogyn I finally woke up, and then created #172 to add this feature. I’ll probably cut a release after the weekend.