webauthn 2.1.0 → 3.4.0

data/lib/webauthn/public_key_credential/request_options.rb

@@ -10,7 +10,7 @@ module WebAuthn
       def initialize(rp_id: nil, allow_credentials: nil, allow: nil, user_verification: nil, **keyword_arguments)
         super(**keyword_arguments)
 
-        @rp_id = rp_id || configuration.rp_id
+        @rp_id = rp_id || relying_party.id
         @allow_credentials = allow_credentials
         @allow = allow
         @user_verification = user_verification
@@ -26,6 +26,16 @@ module WebAuthn
         super.concat([:allow_credentials, :rp_id, :user_verification])
       end
 
+      def default_extensions
+        extensions = super || {}
+
+        if relying_party.legacy_u2f_appid
+          extensions.merge!(appid: relying_party.legacy_u2f_appid)
+        end
+
+        extensions
+      end
+
       def allow_credentials_from_allow
         if allow
           as_public_key_descriptors(allow)

data/lib/webauthn/public_key_credential.rb

@@ -4,25 +4,47 @@ require "webauthn/encoder"
 
 module WebAuthn
   class PublicKeyCredential
-    attr_reader :type, :id, :raw_id, :response
+    class InvalidChallengeError < Error; end
 
-    def self.from_client(credential)
+    attr_reader :type, :id, :raw_id, :client_extension_outputs, :authenticator_attachment, :response
+
+    def self.from_client(credential, relying_party: WebAuthn.configuration.relying_party)
       new(
         type: credential["type"],
         id: credential["id"],
-        raw_id: WebAuthn.configuration.encoder.decode(credential["rawId"]),
-        response: response_class.from_client(credential["response"])
+        raw_id: relying_party.encoder.decode(credential["rawId"]),
+        client_extension_outputs: credential["clientExtensionResults"],
+        authenticator_attachment: credential["authenticatorAttachment"],
+        response: response_class.from_client(credential["response"], relying_party: relying_party),
+        relying_party: relying_party
       )
     end
 
-    def initialize(type:, id:, raw_id:, response:)
+    def initialize(
+      type:,
+      id:,
+      raw_id:,
+      response:,
+      authenticator_attachment: nil,
+      client_extension_outputs: {},
+      relying_party: WebAuthn.configuration.relying_party
+    )
       @type = type
       @id = id
       @raw_id = raw_id
+      @client_extension_outputs = client_extension_outputs
+      @authenticator_attachment = authenticator_attachment
       @response = response
+      @relying_party = relying_party
     end
 
-    def verify(*_args)
+    def verify(challenge, *_args)
+      unless valid_class?(challenge)
+        msg = "challenge must be a String. input challenge class: #{challenge.class}"
+
+        raise(InvalidChallengeError, msg)
+      end
+
       valid_type? || raise("invalid type")
       valid_id? || raise("invalid id")
 
@@ -30,11 +52,25 @@ module WebAuthn
     end
 
     def sign_count
-      response&.authenticator_data&.sign_count
+      authenticator_data&.sign_count
+    end
+
+    def authenticator_extension_outputs
+      authenticator_data.extension_data if authenticator_data&.extension_data_included?
+    end
+
+    def backup_eligible?
+      authenticator_data&.credential_backup_eligible?
+    end
+
+    def backed_up?
+      authenticator_data&.credential_backed_up?
     end
 
     private
 
+    attr_reader :relying_party
+
     def valid_type?
       type == TYPE_PUBLIC_KEY
     end
@@ -43,8 +79,16 @@ module WebAuthn
       raw_id && id && raw_id == WebAuthn.standard_encoder.decode(id)
     end
 
+    def valid_class?(challenge)
+      challenge.is_a?(String)
+    end
+
+    def authenticator_data
+      response&.authenticator_data
+    end
+
     def encoder
-      WebAuthn.configuration.encoder
+      relying_party.encoder
     end
   end
 end

data/lib/webauthn/public_key_credential_with_assertion.rb

@@ -9,14 +9,16 @@ module WebAuthn
       WebAuthn::AuthenticatorAssertionResponse
     end
 
-    def verify(challenge, public_key:, sign_count:, user_verification: nil)
+    def verify(challenge, public_key:, sign_count:, user_presence: nil, user_verification: nil)
       super
 
       response.verify(
         encoder.decode(challenge),
         public_key: encoder.decode(public_key),
         sign_count: sign_count,
-        user_verification: user_verification
+        user_presence: user_presence,
+        user_verification: user_verification,
+        rp_id: appid_extension_output ? appid : nil
       )
 
       true
@@ -31,5 +33,17 @@ module WebAuthn
     def raw_user_handle
       response.user_handle
     end
+
+    private
+
+    def appid_extension_output
+      return if client_extension_outputs.nil?
+
+      client_extension_outputs['appid']
+    end
+
+    def appid
+      URI.parse(relying_party.legacy_u2f_appid || raise("Unspecified legacy U2F AppID")).to_s
+    end
   end
 end

data/lib/webauthn/public_key_credential_with_attestation.rb

@@ -9,10 +9,10 @@ module WebAuthn
       WebAuthn::AuthenticatorAttestationResponse
     end
 
-    def verify(challenge, user_verification: nil)
+    def verify(challenge, user_presence: nil, user_verification: nil)
       super
 
-      response.verify(encoder.decode(challenge), user_verification: user_verification)
+      response.verify(encoder.decode(challenge), user_presence: user_presence, user_verification: user_verification)
 
       true
     end

data/lib/webauthn/relying_party.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "webauthn/credential"
+require "webauthn/encoder"
+require "webauthn/error"
+
+module WebAuthn
+  class RootCertificateFinderNotSupportedError < Error; end
+
+  class RelyingParty
+    DEFAULT_ALGORITHMS = ["ES256", "PS256", "RS256"].compact.freeze
+
+    def self.if_pss_supported(algorithm)
+      OpenSSL::PKey::RSA.instance_methods.include?(:verify_pss) ? algorithm : nil
+    end
+
+    def initialize(
+      algorithms: DEFAULT_ALGORITHMS.dup,
+      encoding: WebAuthn::Encoder::STANDARD_ENCODING,
+      allowed_origins: nil,
+      origin: nil,
+      id: nil,
+      name: nil,
+      verify_attestation_statement: true,
+      credential_options_timeout: 120000,
+      silent_authentication: false,
+      acceptable_attestation_types: ['None', 'Self', 'Basic', 'AttCA', 'Basic_or_AttCA', 'AnonCA'],
+      attestation_root_certificates_finders: [],
+      legacy_u2f_appid: nil
+    )
+      @algorithms = algorithms
+      @encoding = encoding
+      @allowed_origins = allowed_origins
+      @id = id
+      @name = name
+      @verify_attestation_statement = verify_attestation_statement
+      @credential_options_timeout = credential_options_timeout
+      @silent_authentication = silent_authentication
+      @acceptable_attestation_types = acceptable_attestation_types
+      @legacy_u2f_appid = legacy_u2f_appid
+      self.origin = origin
+      self.attestation_root_certificates_finders = attestation_root_certificates_finders
+    end
+
+    attr_accessor :algorithms,
+                  :encoding,
+                  :allowed_origins,
+                  :id,
+                  :name,
+                  :verify_attestation_statement,
+                  :credential_options_timeout,
+                  :silent_authentication,
+                  :acceptable_attestation_types,
+                  :legacy_u2f_appid
+
+    attr_reader :attestation_root_certificates_finders, :origin
+
+    # This is the user-data encoder.
+    # Used to decode user input and to encode data provided to the user.
+    def encoder
+      @encoder ||= WebAuthn::Encoder.new(encoding)
+    end
+
+    def attestation_root_certificates_finders=(finders)
+      if !finders.respond_to?(:each)
+        finders = [finders]
+      end
+
+      finders.each do |finder|
+        unless finder.respond_to?(:find)
+          raise RootCertificateFinderNotSupportedError, "Finder must implement `find` method"
+        end
+      end
+
+      @attestation_root_certificates_finders = finders
+    end
+
+    def options_for_registration(**keyword_arguments)
+      WebAuthn::Credential.options_for_create(
+        **keyword_arguments,
+        relying_party: self
+      )
+    end
+
+    def verify_registration(raw_credential, challenge, user_presence: nil, user_verification: nil)
+      webauthn_credential = WebAuthn::Credential.from_create(raw_credential, relying_party: self)
+
+      if webauthn_credential.verify(challenge, user_presence: user_presence, user_verification: user_verification)
+        webauthn_credential
+      end
+    end
+
+    def options_for_authentication(**keyword_arguments)
+      WebAuthn::Credential.options_for_get(
+        **keyword_arguments,
+        relying_party: self
+      )
+    end
+
+    def verify_authentication(
+      raw_credential,
+      challenge,
+      user_presence: nil,
+      user_verification: nil,
+      public_key: nil,
+      sign_count: nil
+    )
+      webauthn_credential = WebAuthn::Credential.from_get(raw_credential, relying_party: self)
+
+      stored_credential = yield(webauthn_credential) if block_given?
+
+      if webauthn_credential.verify(
+        challenge,
+        public_key: public_key || stored_credential.public_key,
+        sign_count: sign_count || stored_credential.sign_count,
+        user_presence: user_presence,
+        user_verification: user_verification
+      )
+        block_given? ? [webauthn_credential, stored_credential] : webauthn_credential
+      end
+    end
+
+    # DEPRECATED: This method will be removed in future.
+    def origin=(new_origin)
+      return if new_origin.nil?
+
+      warn(
+        "DEPRECATION WARNING: `WebAuthn.origin` is deprecated and will be removed in future. "\
+        "Please use `WebAuthn.allowed_origins` instead "\
+        "that also allows configuring multiple origins per Relying Party"
+      )
+
+      @allowed_origins ||= Array(new_origin) # rubocop:disable Naming/MemoizedInstanceVariableName
+    end
+  end
+end

data/lib/webauthn/u2f_migrator.rb

@@ -28,10 +28,14 @@ module WebAuthn
     end
 
     def credential
-      @credential ||= begin
-        hash = authenticator_data.send(:credential)
-        WebAuthn::AuthenticatorData::AttestedCredentialData::Credential.new(hash[:id], hash[:public_key].serialize)
-      end
+      @credential ||=
+        begin
+          hash = authenticator_data.send(:credential)
+          WebAuthn::AuthenticatorData::AttestedCredentialData::Credential.new(
+            id: hash[:id],
+            public_key: hash[:public_key].serialize
+          )
+        end
     end
 
     def attestation_type

data/lib/webauthn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebAuthn
-  VERSION = "2.1.0"
+  VERSION = "3.4.0"
 end

data/lib/webauthn.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "webauthn/json_serializer"
 require "webauthn/configuration"
 require "webauthn/credential"
 require "webauthn/credential_creation_options"

data/webauthn.gemspec

@@ -22,28 +22,31 @@ Gem::Specification.new do |spec|
     "source_code_uri" => "https://github.com/cedarcode/webauthn-ruby"
   }
 
-  spec.files = `git ls-files -z`.split("\x0").reject do |f|
-    f.match(%r{^(test|spec|features|assets)/})
-  end
+  spec.files =
+    `git ls-files -z`.split("\x0").reject do |f|
+      f.match(%r{^(test|spec|features|assets)/})
+    end
+
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.3"
+  spec.required_ruby_version = ">= 2.5"
 
-  spec.add_dependency "awrence", "~> 1.1"
+  spec.add_dependency "android_key_attestation", "~> 0.3.0"
   spec.add_dependency "bindata", "~> 2.4"
   spec.add_dependency "cbor", "~> 0.5.9"
-  spec.add_dependency "cose", "~> 0.10.0"
-  spec.add_dependency "jwt", [">= 1.5", "< 3.0"]
-  spec.add_dependency "openssl", "~> 2.0"
-  spec.add_dependency "securecompare", "~> 1.0"
+  spec.add_dependency "cose", "~> 1.1"
+  spec.add_dependency "openssl", ">= 2.2"
+  spec.add_dependency "safety_net_attestation", "~> 0.4.0"
+  spec.add_dependency "tpm-key_attestation", "~> 0.14.0"
 
-  spec.add_development_dependency "appraisal", "~> 2.2.0"
+  spec.add_development_dependency "base64", ">= 0.1.0"
   spec.add_development_dependency "bundler", ">= 1.17", "< 3.0"
   spec.add_development_dependency "byebug", "~> 11.0"
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.8"
-  spec.add_development_dependency "rubocop", "0.75.0"
-  spec.add_development_dependency "timecop", "~> 0.9.1"
+  spec.add_development_dependency "rubocop", "~> 1.9.1"
+  spec.add_development_dependency "rubocop-rake", "~> 0.5.1"
+  spec.add_development_dependency "rubocop-rspec", "~> 2.2.0"
 end

metadata

@@ -1,30 +1,30 @@
 --- !ruby/object:Gem::Specification
 name: webauthn
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 3.4.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
 - Braulio Martinez
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-12-30 00:00:00.000000000 Z
+date: 2025-02-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: awrence
+  name: android_key_attestation
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: 0.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.1'
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: bindata
   requirement: !ruby/object:Gem::Requirement
@@ -59,76 +59,70 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '1.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.10.0
+        version: '1.1'
 - !ruby/object:Gem::Dependency
-  name: jwt
+  name: openssl
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.5'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.5'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
 - !ruby/object:Gem::Dependency
-  name: openssl
+  name: safety_net_attestation
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: 0.4.0
 - !ruby/object:Gem::Dependency
-  name: securecompare
+  name: tpm-key_attestation
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.14.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.14.0
 - !ruby/object:Gem::Dependency
-  name: appraisal
+  name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: 0.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 2.2.0
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -195,30 +189,44 @@ dependencies:
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.9.1
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.75.0
+        version: 0.5.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.75.0
+        version: 0.5.1
 - !ruby/object:Gem::Dependency
-  name: timecop
+  name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.1
+        version: 2.2.0
 description: |-
   WebAuthn ruby server library ― Make your application a W3C Web Authentication conformant
       Relying Party and allow your users to authenticate with U2F and FIDO2 authenticators.
@@ -229,11 +237,12 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
+- ".github/workflows/build.yml"
+- ".github/workflows/git.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
-- ".travis.yml"
-- Appraisals
 - CHANGELOG.md
 - CONTRIBUTING.md
 - Gemfile
@@ -243,34 +252,21 @@ files:
 - SECURITY.md
 - bin/console
 - bin/setup
+- docs/advanced_configuration.md
 - docs/u2f_migration.md
-- gemfiles/cose_head.gemfile
-- gemfiles/openssl_2_0.gemfile
-- gemfiles/openssl_2_1.gemfile
-- gemfiles/openssl_head.gemfile
-- lib/android_safetynet/attestation_response.rb
-- lib/cose/rsassa_algorithm.rb
-- lib/tpm/constants.rb
-- lib/tpm/s_attest.rb
-- lib/tpm/s_attest/s_certify_info.rb
-- lib/tpm/sized_buffer.rb
-- lib/tpm/t_public.rb
-- lib/tpm/t_public/s_ecc_parms.rb
-- lib/tpm/t_public/s_rsa_parms.rb
+- lib/cose/rsapkcs1_algorithm.rb
 - lib/webauthn.rb
+- lib/webauthn/attestation_object.rb
 - lib/webauthn/attestation_statement.rb
 - lib/webauthn/attestation_statement/android_key.rb
-- lib/webauthn/attestation_statement/android_key/authorization_list.rb
-- lib/webauthn/attestation_statement/android_key/key_description.rb
 - lib/webauthn/attestation_statement/android_safetynet.rb
+- lib/webauthn/attestation_statement/apple.rb
 - lib/webauthn/attestation_statement/base.rb
 - lib/webauthn/attestation_statement/fido_u2f.rb
 - lib/webauthn/attestation_statement/fido_u2f/public_key.rb
 - lib/webauthn/attestation_statement/none.rb
 - lib/webauthn/attestation_statement/packed.rb
 - lib/webauthn/attestation_statement/tpm.rb
-- lib/webauthn/attestation_statement/tpm/cert_info.rb
-- lib/webauthn/attestation_statement/tpm/pub_area.rb
 - lib/webauthn/authenticator_assertion_response.rb
 - lib/webauthn/authenticator_attestation_response.rb
 - lib/webauthn/authenticator_data.rb
@@ -291,6 +287,7 @@ files:
 - lib/webauthn/fake_authenticator/attestation_object.rb
 - lib/webauthn/fake_authenticator/authenticator_data.rb
 - lib/webauthn/fake_client.rb
+- lib/webauthn/json_serializer.rb
 - lib/webauthn/public_key.rb
 - lib/webauthn/public_key_credential.rb
 - lib/webauthn/public_key_credential/creation_options.rb
@@ -301,8 +298,7 @@ files:
 - lib/webauthn/public_key_credential/user_entity.rb
 - lib/webauthn/public_key_credential_with_assertion.rb
 - lib/webauthn/public_key_credential_with_attestation.rb
-- lib/webauthn/security_utils.rb
-- lib/webauthn/signature_verifier.rb
+- lib/webauthn/relying_party.rb
 - lib/webauthn/u2f_migrator.rb
 - lib/webauthn/version.rb
 - webauthn.gemspec
@@ -313,7 +309,7 @@ metadata:
   bug_tracker_uri: https://github.com/cedarcode/webauthn-ruby/issues
   changelog_uri: https://github.com/cedarcode/webauthn-ruby/blob/master/CHANGELOG.md
   source_code_uri: https://github.com/cedarcode/webauthn-ruby
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -321,15 +317,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.3'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.5.11
+signing_key:
 specification_version: 4
 summary: WebAuthn ruby server library
 test_files: []