CborDecode()

edit

Decodes CBOR (Concise Binary Object Representation) binary data into native CFML types. CBOR is a binary data format similar to JSON but more compact and efficient — it's used by WebAuthn/passkeys, IoT protocols, and other systems where size and speed matter.

Returns the appropriate CFML type: struct, array, string, number, binary, or boolean.

Requires Extension: Crypto Extension

CborDecode( data=any, options=struct );

Returns: any

Argument Description
data
any, required 		edit

CBOR-encoded binary data
options
struct, optional 		edit

Optional struct with: preserveTags (boolean, default true) - when false, tagged values are unwrapped to just the inner value

Usage Notes

edit

CBOR maps can have integer keys (e.g. COSE keys use 1, 3, -1), but CFML struct keys are always strings. Integer keys are converted to their string representation — so CBOR key 1 becomes struct key "1". See CborEncode() for how this is handled on re-encoding.

Tagged values: Some CBOR protocols use tags to mark the meaning of a value (e.g. tag 1 = epoch timestamp). By default, tagged values are returned as { tag: N, value: ... }. Pass { preserveTags: false } to unwrap them and get just the inner value.

Binary data: Unlike JSON, CBOR natively supports binary (byte strings). These are returned as CFML binary values, not base64-encoded strings.

Examples

edit 
// Decode CBOR bytes back into a CFML struct
cbor = CborEncode( { name: "Zac", age: 42 } );
data = CborDecode( cbor );
// data.name == "Zac", data.age == 42

// Works with all CFML types: arrays, strings, numbers, booleans, binary
cbor = CborEncode( [ 1, "two", true, 3.14 ] );
arr = CborDecode( cbor );
// arr[1] == 1, arr[2] == "two", arr[3] == true

// Binary data survives the roundtrip (unlike JSON which can't hold binary)
payload = charsetDecode( "binary payload", "UTF-8" );
decoded = CborDecode( CborEncode( payload ) );
// isBinary( decoded ) == true

// Tagged CBOR values (used by some protocols to mark types like timestamps)
// are returned as structs with "tag" and "value" keys by default
// Set preserveTags=false to just get the inner value without the tag wrapper
data = { key: "value" };
decoded = CborDecode( CborEncode( data ), { preserveTags: false } );
// decoded.key == "value"

// WebAuthn: decode the attestation object from a passkey registration
attestationObject = CborDecode( Base64UrlDecode( response.attestationObject ) );
// attestationObject.fmt, attestationObject.authData, attestationObject.attStmt

See also