fix(creation-profiles): default rp.name to rp.id when empty (#893)

[Spomky]

Summary

Refs #893 (the framework side; the documentation legs are tracked in web-auth/doc#57, web-auth/doc#58 and web-auth/doc#59).

Per W3C IDL, PublicKeyCredentialEntity.name is required:

dictionary PublicKeyCredentialEntity {
    required DOMString name;
};

The 5.3.0 release deprecated the webauthn.creation_profiles.*.rp.name configuration node. When users follow the deprecation message and remove the node, the configuration default falls back to '', so PublicKeyCredentialCreationOptionsFactory::createRpEntity produced {"rp": {"name": "", "id": "..."}}.

Recent Chrome / Firefox builds tolerate the empty name and fall back to the eTLD+1, but SimpleWebAuthn's browser bindings (@simplewebauthn/browser@13.x, pulled in by @web-auth/webauthn-stimulus@5.3.x) refuse to call navigator.credentials.create() when rp.name is empty: the registration silently fails after the options endpoint returns 200.

Fix

When the configured rp.name is an empty string, fall back to the rp.id. The id is a human-readable hostname and is therefore a sensible default display label, and the JSON now always carries a non-empty name.

This mirrors the equivalent fix on the 5.4 helper API in #889.

BC

Strictly additive on the runtime serialisation side: profiles that still configure a non-empty rp.name are unchanged, and the deprecated node keeps emitting the same deprecation warning at config-build time.

[zll600]

@Spomky Thank you for fix this on the 5.3.x.

Another issue I found is current deprecation message is misleading for developer to use the web-auth/webauthn-lib inaccurately.

The deprecation message:

webauthn-framework/src/webauthn/src/PublicKeyCredentialEntity.php

Line 25 in 2e832f8

'The parameter "$name" is deprecated since 5.3.0 and will be removed in 6.0.0. Please set "" and use PublicKeyCredentialUserEntity.name instead.'

For the PublicKeyCredentialRpEntity.name, the empty string '' is rejected by some libraries like #745 (comment) mentioned example.

What do you think correcting the deprecation message to set PublicKeyCredentialRpEntity.name the PublicKeyCredentialRpEntity.id like this PR does?

Otherwise, I think we could remove it first and add this deprecation back in future to avoid the current misleading which may break some systems.

[zll600]

@Spomky Thank you for fix this on the 5.3.x.

Another issue I found is current deprecation message is misleading for developer to use the web-auth/webauthn-lib inaccurately.

The deprecation message:

webauthn-framework/src/webauthn/src/PublicKeyCredentialEntity.php

Line 25 in 2e832f8

'The parameter "$name" is deprecated since 5.3.0 and will be removed in 6.0.0. Please set "" and use PublicKeyCredentialUserEntity.name instead.'

For the PublicKeyCredentialRpEntity.name, the empty string '' is rejected by some libraries like #745 (comment) mentioned example.

What do you think correcting the deprecation message to set PublicKeyCredentialRpEntity.name the PublicKeyCredentialRpEntity.id like this PR does?

Otherwise, I think we could remove it first and add this deprecation back in future to avoid the current misleading which may break some systems.

Hi @Spomky , Could you please take a look?