Question 1

How does fxamacker/cbor compare to ugorji/go for CBOR in Go?

Accepted Answer

fxamacker/cbor focuses on security with configurable limits and fast rejection of malformed data, while ugorji/go may offer raw speed but is less hardened against adversarial inputs. fxamacker/cbor also has a more familiar API similar to encoding/json.

Question 2

How to use struct tags in fxamacker/cbor to reduce encoded size?

Accepted Answer

Add tags like `cbor:",toarray"` or `cbor:",keyasint"` to struct fields. For example, `toarray` encodes structs as CBOR arrays without field names, reducing size significantly—a nested struct can encode to 1 byte versus 18 bytes for JSON.

Question 3

Is fxamacker/cbor secure for decoding untrusted data?

Accepted Answer

Yes, it includes security features like configurable limits for max array elements and nested levels, and fast rejection of malformed CBOR. It passed multiple security assessments, including a nonconfidential one by NCC Group for Microsoft.

Question 4

Can fxamacker/cbor handle CBOR sequences?

Accepted Answer

Yes, it supports CBOR Sequences (RFC 8742) with functions like UnmarshalFirst and DiagnoseFirst, which decode sequences item by item and return remaining bytes.

Question 5

What are the performance benchmarks for fxamacker/cbor?

Accepted Answer

Benchmarks in the README show it rejects malicious CBOR data in about 47 nanoseconds per operation, much faster than other libraries. Encoding and decoding are optimized for speed without using Go's unsafe package.

Question 6

How to set up custom encoding modes in fxamacker/cbor?

Accepted Answer

Create EncOptions from presets like CoreDetEncOptions(), adjust settings if needed, then use EncMode() to get an immutable mode. For example: opts := cbor.CoreDetEncOptions(); em, err := opts.EncMode(). This mode is safe for concurrent reuse.

Question 7

Does fxamacker/cbor support WebAuthn or CTAP2 Canonical CBOR?

Accepted Answer

Yes, it includes a CTAP2EncOptions preset for CTAP2 Canonical CBOR, which is required for WebAuthn implementations, ensuring compliance with FIDO2 standards.

cbor

What is cbor?

Overview

Use Cases

Best For

Related Projects

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions