webauthn 3.4.0 → 3.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/actions/install-openssl/action.yml +55 -0
- data/.github/actions/install-ruby/action.yml +84 -0
- data/.github/workflows/build.yml +40 -8
- data/.github/workflows/git.yml +1 -1
- data/.rubocop.yml +1 -1
- data/CHANGELOG.md +12 -0
- data/README.md +2 -2
- data/docs/advanced_configuration.md +10 -9
- data/lib/webauthn/attestation_statement/base.rb +1 -1
- data/lib/webauthn/encoder.rb +5 -42
- data/lib/webauthn/encoders.rb +62 -0
- data/lib/webauthn/u2f_migrator.rb +5 -3
- data/lib/webauthn/version.rb +1 -1
- data/webauthn.gemspec +4 -5
- metadata +22 -27
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 50b5c2c43f3e5719dd1ed0f63e9a7bb9705f2f1e97861ab0a0ee0a7d61c4ee41
|
|
4
|
+
data.tar.gz: d8849b387d30e54f7a45fd66bcb2b164983100b0b3369ca8fbf52840261e7fe4
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 4189cd8d89340585a464e6d9368b6ea532c7c59189cbd47022a04d767ec230979076652e333e70878dcead127688d7fe01e57706f63afe325eb1ec5673cf851a
|
|
7
|
+
data.tar.gz: 1cba3b28cd9388256f6d47493fb151f7732ad8680da5863476d4b5e237db7389e362f7a2543bc1447cd0e205e44134957cfa2e4ceb43e9fb32a6b5f851ff349a
|
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
name: Install OpenSSL
|
|
2
|
+
|
|
3
|
+
inputs:
|
|
4
|
+
version:
|
|
5
|
+
description: 'The version of OpenSSL to install'
|
|
6
|
+
required: true
|
|
7
|
+
|
|
8
|
+
runs:
|
|
9
|
+
using: 'composite'
|
|
10
|
+
steps:
|
|
11
|
+
- name: Restore cached OpenSSL library
|
|
12
|
+
id: cache-openssl-restore
|
|
13
|
+
uses: actions/cache/restore@v4
|
|
14
|
+
with:
|
|
15
|
+
path: ~/openssl
|
|
16
|
+
key: openssl-${{ inputs.version }}
|
|
17
|
+
|
|
18
|
+
- name: Compile OpenSSL library
|
|
19
|
+
if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
|
|
20
|
+
shell: bash
|
|
21
|
+
run: |
|
|
22
|
+
mkdir -p tmp/build-openssl && cd tmp/build-openssl
|
|
23
|
+
case ${{ inputs.version }} in
|
|
24
|
+
1.1.*)
|
|
25
|
+
OPENSSL_COMMIT=OpenSSL_
|
|
26
|
+
OPENSSL_COMMIT+=$(echo ${{ inputs.version }} | sed -e 's/\./_/g')
|
|
27
|
+
git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
|
|
28
|
+
echo "Git commit: $(git rev-parse HEAD)"
|
|
29
|
+
./Configure --prefix=$HOME/openssl --libdir=lib linux-x86_64
|
|
30
|
+
make depend && make -j4 && make install_sw
|
|
31
|
+
;;
|
|
32
|
+
3.*)
|
|
33
|
+
OPENSSL_COMMIT=openssl-
|
|
34
|
+
OPENSSL_COMMIT+=$(echo ${{ inputs.version }})
|
|
35
|
+
git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
|
|
36
|
+
echo "Git commit: $(git rev-parse HEAD)"
|
|
37
|
+
if [[ ${{ inputs.version }} == 3.5* ]]; then
|
|
38
|
+
./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests no-legacy
|
|
39
|
+
else
|
|
40
|
+
./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests
|
|
41
|
+
fi
|
|
42
|
+
make -j4 && make install_sw && make install_fips
|
|
43
|
+
;;
|
|
44
|
+
*)
|
|
45
|
+
echo "Don't know how to build OpenSSL ${{ inputs.version }}"
|
|
46
|
+
;;
|
|
47
|
+
esac
|
|
48
|
+
|
|
49
|
+
- name: Save OpenSSL library cache
|
|
50
|
+
if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
|
|
51
|
+
id: cache-openssl-save
|
|
52
|
+
uses: actions/cache/save@v4
|
|
53
|
+
with:
|
|
54
|
+
path: ~/openssl
|
|
55
|
+
key: ${{ steps.cache-openssl-restore.outputs.cache-primary-key }}
|
|
@@ -0,0 +1,84 @@
|
|
|
1
|
+
name: Install Ruby
|
|
2
|
+
|
|
3
|
+
inputs:
|
|
4
|
+
version:
|
|
5
|
+
description: 'The version of Ruby to install'
|
|
6
|
+
required: true
|
|
7
|
+
openssl-version:
|
|
8
|
+
description: 'The version of OpenSSL used'
|
|
9
|
+
required: true
|
|
10
|
+
|
|
11
|
+
runs:
|
|
12
|
+
using: 'composite'
|
|
13
|
+
steps:
|
|
14
|
+
- name: Restore cached Ruby installation
|
|
15
|
+
id: cache-ruby-restore
|
|
16
|
+
uses: actions/cache/restore@v4
|
|
17
|
+
with:
|
|
18
|
+
path: ~/rubies/ruby-${{ inputs.version }}
|
|
19
|
+
key: ruby-${{ inputs.version }}-with-openssl-${{ inputs.openssl-version }}
|
|
20
|
+
|
|
21
|
+
- name: Install Ruby
|
|
22
|
+
if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
|
|
23
|
+
shell: bash
|
|
24
|
+
run: |
|
|
25
|
+
latest_patch=$(curl -s https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ \
|
|
26
|
+
| grep -oP "ruby-${{ inputs.version }}\.\d+\.tar\.xz" \
|
|
27
|
+
| grep -oP "\d+(?=\.tar\.xz)" \
|
|
28
|
+
| sort -V | tail -n 1)
|
|
29
|
+
wget https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
|
30
|
+
tar -xJvf ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
|
31
|
+
cd ruby-${{ inputs.version }}.${latest_patch}
|
|
32
|
+
./configure --prefix=$HOME/rubies/ruby-${{ inputs.version }} --with-openssl-dir=$HOME/openssl
|
|
33
|
+
make
|
|
34
|
+
make install
|
|
35
|
+
|
|
36
|
+
- name: Update PATH
|
|
37
|
+
shell: bash
|
|
38
|
+
run: |
|
|
39
|
+
echo "~/rubies/ruby-${{ inputs.version }}/bin" >> $GITHUB_PATH
|
|
40
|
+
|
|
41
|
+
- name: Install Bundler
|
|
42
|
+
shell: bash
|
|
43
|
+
run: |
|
|
44
|
+
case ${{ inputs.version }} in
|
|
45
|
+
2.7* | 3.*)
|
|
46
|
+
echo "Skipping Bundler installation for Ruby ${{ inputs.version }}"
|
|
47
|
+
;;
|
|
48
|
+
2.5* | 2.6*)
|
|
49
|
+
gem install bundler -v '~> 2.3.0'
|
|
50
|
+
;;
|
|
51
|
+
*)
|
|
52
|
+
echo "Don't know how to install Bundler for Ruby ${{ inputs.version }}"
|
|
53
|
+
;;
|
|
54
|
+
esac
|
|
55
|
+
|
|
56
|
+
- name: Save Ruby installation cache
|
|
57
|
+
if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
|
|
58
|
+
id: cache-ruby-save
|
|
59
|
+
uses: actions/cache/save@v4
|
|
60
|
+
with:
|
|
61
|
+
path: ~/rubies/ruby-${{ inputs.version }}
|
|
62
|
+
key: ${{ steps.cache-ruby-restore.outputs.cache-primary-key }}
|
|
63
|
+
|
|
64
|
+
- name: Cache Bundler Install
|
|
65
|
+
id: cache-bundler-restore
|
|
66
|
+
uses: actions/cache/restore@v4
|
|
67
|
+
env:
|
|
68
|
+
GEMFILE: ${{ env.BUNDLE_GEMFILE || 'Gemfile' }}
|
|
69
|
+
with:
|
|
70
|
+
path: ~/bundler/cache
|
|
71
|
+
key: bundler-ruby-${{ inputs.version }}-${{ inputs.openssl-version }}-${{ hashFiles(env.Gemfile, 'webauthn.gemspec') }}
|
|
72
|
+
|
|
73
|
+
- name: Install dependencies
|
|
74
|
+
shell: bash
|
|
75
|
+
run: |
|
|
76
|
+
bundle config set --local path ~/bundler/cache
|
|
77
|
+
bundle install
|
|
78
|
+
|
|
79
|
+
- name: Save Bundler Install cache
|
|
80
|
+
id: cache-bundler-save
|
|
81
|
+
uses: actions/cache/save@v4
|
|
82
|
+
with:
|
|
83
|
+
path: ~/bundler/cache
|
|
84
|
+
key: ${{ steps.cache-bundler-restore.outputs.cache-primary-key }}
|
data/.github/workflows/build.yml
CHANGED
|
@@ -15,6 +15,7 @@ on:
|
|
|
15
15
|
|
|
16
16
|
jobs:
|
|
17
17
|
test:
|
|
18
|
+
name: 'Test Ruby ${{ matrix.ruby }} with OpenSSL ${{ matrix.openssl }}'
|
|
18
19
|
runs-on: ubuntu-24.04
|
|
19
20
|
strategy:
|
|
20
21
|
fail-fast: false
|
|
@@ -24,17 +25,48 @@ jobs:
|
|
|
24
25
|
- '3.3'
|
|
25
26
|
- '3.2'
|
|
26
27
|
- '3.1'
|
|
27
|
-
|
|
28
|
-
- '
|
|
29
|
-
- '2
|
|
30
|
-
- '
|
|
31
|
-
-
|
|
28
|
+
openssl:
|
|
29
|
+
- '3.5.3'
|
|
30
|
+
- '3.4.2'
|
|
31
|
+
- '3.3.4'
|
|
32
|
+
- '3.2.5'
|
|
33
|
+
- '3.1.8'
|
|
34
|
+
- '3.0.17'
|
|
35
|
+
- '1.1.1w'
|
|
36
|
+
include:
|
|
37
|
+
- ruby: truffleruby
|
|
38
|
+
- ruby: '3.0'
|
|
39
|
+
openssl: '1.1.1w'
|
|
40
|
+
- ruby: '2.7'
|
|
41
|
+
openssl: '1.1.1w'
|
|
42
|
+
- ruby: '2.6'
|
|
43
|
+
openssl: '1.1.1w'
|
|
44
|
+
- ruby: '2.5'
|
|
45
|
+
openssl: '1.1.1w'
|
|
46
|
+
|
|
32
47
|
steps:
|
|
33
|
-
- uses: actions/checkout@
|
|
34
|
-
|
|
48
|
+
- uses: actions/checkout@v5
|
|
49
|
+
|
|
50
|
+
- name: Install OpenSSL
|
|
51
|
+
if: matrix.ruby != 'truffleruby'
|
|
52
|
+
uses: ./.github/actions/install-openssl
|
|
53
|
+
with:
|
|
54
|
+
version: ${{ matrix.openssl }}
|
|
55
|
+
|
|
56
|
+
- name: Manually set up Ruby
|
|
57
|
+
if: matrix.ruby != 'truffleruby'
|
|
58
|
+
uses: ./.github/actions/install-ruby
|
|
59
|
+
with:
|
|
60
|
+
version: ${{ matrix.ruby }}
|
|
61
|
+
openssl-version: ${{ matrix.openssl }}
|
|
62
|
+
|
|
63
|
+
- name: Set up Ruby
|
|
64
|
+
if: matrix.ruby == 'truffleruby'
|
|
65
|
+
uses: ruby/setup-ruby@v1
|
|
35
66
|
with:
|
|
36
67
|
ruby-version: ${{ matrix.ruby }}
|
|
37
68
|
bundler-cache: true
|
|
69
|
+
|
|
38
70
|
- run: bundle exec rspec
|
|
39
71
|
env:
|
|
40
72
|
RUBYOPT: ${{ startsWith(matrix.ruby, '3.4') && '--enable=frozen-string-literal' || '' }}
|
|
@@ -42,7 +74,7 @@ jobs:
|
|
|
42
74
|
lint:
|
|
43
75
|
runs-on: ubuntu-latest
|
|
44
76
|
steps:
|
|
45
|
-
- uses: actions/checkout@
|
|
77
|
+
- uses: actions/checkout@v5
|
|
46
78
|
- uses: ruby/setup-ruby@v1
|
|
47
79
|
with:
|
|
48
80
|
ruby-version: '3.3'
|
data/.github/workflows/git.yml
CHANGED
data/.rubocop.yml
CHANGED
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,15 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [v3.4.2] - 2025-09-22
|
|
4
|
+
|
|
5
|
+
### Added
|
|
6
|
+
|
|
7
|
+
- Updated `safety_net_attestation` dependency from `~> 0.4.0` to `~> 0.5.0`.
|
|
8
|
+
|
|
9
|
+
## [v3.4.1] - 2025-06-06
|
|
10
|
+
|
|
11
|
+
- Avoid requiring `base64` as it's not a direct dependency. [#459](https://github.com/cedarcode/webauthn-ruby/pull/459)[@santiagorodriguez96]
|
|
12
|
+
|
|
3
13
|
## [v3.4.0] - 2025-02-17
|
|
4
14
|
|
|
5
15
|
- Added support for Webauthn.config and RelayingParty to accept multiple allowed_origins. [#431](https://github.com/cedarcode/webauthn-ruby/pull/431)[@obroshnij]
|
|
@@ -417,6 +427,8 @@ Note: Both additions should help making it compatible with Chrome for Android 70
|
|
|
417
427
|
- `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
|
|
418
428
|
- Works with ruby 2.5
|
|
419
429
|
|
|
430
|
+
[v3.4.2]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.1...v3.4.2/
|
|
431
|
+
[v3.4.1]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.0...v3.4.1/
|
|
420
432
|
[v3.4.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.3.0...v3.4.0/
|
|
421
433
|
[v3.3.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.2.2...v3.3.0/
|
|
422
434
|
[v3.2.2]: https://github.com/cedarcode/webauthn-ruby/compare/v3.2.1...v3.2.2/
|
data/README.md
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
|
|
2
|
-
For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/
|
|
1
|
+
> [!warning]
|
|
2
|
+
> You are viewing the README for the development version of webauthn-ruby. For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/3-stable/README.md.
|
|
3
3
|
|
|
4
4
|
# webauthn-ruby
|
|
5
5
|
|
|
@@ -4,24 +4,25 @@
|
|
|
4
4
|
|
|
5
5
|
Which approach suits best your needs will depend on the architecture of your application and how do your users need to register and authenticate to it.
|
|
6
6
|
|
|
7
|
-
If you have a multi-tenant application, or any application
|
|
7
|
+
If you have a multi-tenant application, or any application segmentation, where your users register and authenticate to each of these tenants or segments individually using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
|
|
8
8
|
|
|
9
|
-
However, if your application is served for just one hostname, or else if your users authenticate to only one
|
|
9
|
+
However, if your application is served for just one hostname, or else if your users authenticate to only one subdomain (e.g. your application serves www.example.com and admin.example.com but all your users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
|
|
10
10
|
|
|
11
11
|
If you are still not sure, or want to keep your options open, be aware that [Instance Based Configuration](#instance-based-configuration) is also a valid way of defining a single instance configuration and how you share such configuration across your application, it's up to you.
|
|
12
12
|
|
|
13
13
|
|
|
14
14
|
## Instance Based Configuration
|
|
15
15
|
|
|
16
|
-
|
|
16
|
+
Instead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
|
|
17
17
|
you can now have an on-demand instance of `WebAuthn::RelyingParty` with the same configuration options, that
|
|
18
|
-
you can build anywhere in
|
|
18
|
+
you can build anywhere in your application, in the following way:
|
|
19
19
|
|
|
20
20
|
```ruby
|
|
21
21
|
relying_party = WebAuthn::RelyingParty.new(
|
|
22
22
|
# This value needs to match `window.location.origin` evaluated by
|
|
23
23
|
# the User Agent during registration and authentication ceremonies.
|
|
24
|
-
origin
|
|
24
|
+
# Multiple origins can be used when needed. Using more than one will imply you MUST configure rp_id explicitely. If you need your credentials to be bound to a single origin but you have more than one tenant, please see [our Advanced Configuration section](https://github.com/cedarcode/webauthn-ruby/blob/master/docs/advanced_configuration.md) instead of adding multiple origins.
|
|
25
|
+
allowed_origins: ["https://admin.example.com"],
|
|
25
26
|
|
|
26
27
|
# Relying Party name for display purposes
|
|
27
28
|
name: "Admin Site for Example Inc."
|
|
@@ -57,7 +58,7 @@ Intead of the [Global Configuration](../README.md#configuration) you place in `c
|
|
|
57
58
|
|
|
58
59
|
## Instance Based API
|
|
59
60
|
|
|
60
|
-
**DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been
|
|
61
|
+
**DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been thoroughly tested and it is fully functional it might be changed until the final release of version 3.0.0.**
|
|
61
62
|
|
|
62
63
|
The explanation for each ceremony can be found in depth in [Credential Registration](../README.md#credential-registration) and [Credential Authentication](../README.md#credential-authentication) but if you choose this instance based approach to define your WebAuthn configurations and assuming `relying_party` is the result of an instance you get through `WebAuthn::RelyingParty.new(...)` the code in those explanations needs to be updated to:
|
|
63
64
|
|
|
@@ -101,7 +102,7 @@ session[:creation_challenge] = options.challenge
|
|
|
101
102
|
begin
|
|
102
103
|
webauthn_credential = relying_party.verify_registration(
|
|
103
104
|
params[:publicKeyCredential],
|
|
104
|
-
|
|
105
|
+
session[:creation_challenge]
|
|
105
106
|
)
|
|
106
107
|
|
|
107
108
|
# Store Credential ID, Credential Public Key and Sign Count for future authentications
|
|
@@ -159,7 +160,7 @@ begin
|
|
|
159
160
|
# Continue with successful sign in or 2FA verification...
|
|
160
161
|
|
|
161
162
|
rescue WebAuthn::SignCountVerificationError => e
|
|
162
|
-
# Cryptographic verification of the authenticator data succeeded, but the signature counter was less
|
|
163
|
+
# Cryptographic verification of the authenticator data succeeded, but the signature counter was less than or equal
|
|
163
164
|
# to the stored value. This can have several reasons and depending on your risk tolerance you can choose to fail or
|
|
164
165
|
# pass authentication. For more information see https://www.w3.org/TR/webauthn/#sign-counter
|
|
165
166
|
rescue WebAuthn::Error => e
|
|
@@ -171,4 +172,4 @@ end
|
|
|
171
172
|
|
|
172
173
|
Adding a configuration for a new instance does not mean you need to get rid of your Global configuration. They can co-exist in your application and be both available for the different usages you might have. `WebAuthn.configuration.relying_party` will always return the global one while `WebAuthn::RelyingParty.new`, executed anywhere in your codebase, will allow you to create a different instance as you see the need. They will not collide and instead operate in isolation without any shared state.
|
|
173
174
|
|
|
174
|
-
The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is
|
|
175
|
+
The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still be valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintained globally at `WebAuthn.configuration.relying_party`.
|
data/lib/webauthn/encoder.rb
CHANGED
|
@@ -1,55 +1,18 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
-
require "
|
|
3
|
+
require "webauthn/encoders"
|
|
4
4
|
|
|
5
5
|
module WebAuthn
|
|
6
|
-
def self.standard_encoder
|
|
7
|
-
@standard_encoder ||= Encoder.new
|
|
8
|
-
end
|
|
9
|
-
|
|
10
6
|
class Encoder
|
|
7
|
+
extend Forwardable
|
|
8
|
+
|
|
11
9
|
# https://www.w3.org/TR/webauthn-2/#base64url-encoding
|
|
12
10
|
STANDARD_ENCODING = :base64url
|
|
13
11
|
|
|
14
|
-
|
|
12
|
+
def_delegators :@encoder_klass, :encode, :decode
|
|
15
13
|
|
|
16
14
|
def initialize(encoding = STANDARD_ENCODING)
|
|
17
|
-
@
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
def encode(data)
|
|
21
|
-
case encoding
|
|
22
|
-
when :base64
|
|
23
|
-
[data].pack("m0") # Base64.strict_encode64(data)
|
|
24
|
-
when :base64url
|
|
25
|
-
data = [data].pack("m0") # Base64.urlsafe_encode64(data, padding: false)
|
|
26
|
-
data.chomp!("==") or data.chomp!("=")
|
|
27
|
-
data.tr!("+/", "-_")
|
|
28
|
-
data
|
|
29
|
-
when nil, false
|
|
30
|
-
data
|
|
31
|
-
else
|
|
32
|
-
raise "Unsupported or unknown encoding: #{encoding}"
|
|
33
|
-
end
|
|
34
|
-
end
|
|
35
|
-
|
|
36
|
-
def decode(data)
|
|
37
|
-
case encoding
|
|
38
|
-
when :base64
|
|
39
|
-
data.unpack1("m0") # Base64.strict_decode64(data)
|
|
40
|
-
when :base64url
|
|
41
|
-
if !data.end_with?("=") && data.length % 4 != 0 # Base64.urlsafe_decode64(data)
|
|
42
|
-
data = data.ljust((data.length + 3) & ~3, "=")
|
|
43
|
-
data.tr!("-_", "+/")
|
|
44
|
-
else
|
|
45
|
-
data = data.tr("-_", "+/")
|
|
46
|
-
end
|
|
47
|
-
data.unpack1("m0")
|
|
48
|
-
when nil, false
|
|
49
|
-
data
|
|
50
|
-
else
|
|
51
|
-
raise "Unsupported or unknown encoding: #{encoding}"
|
|
52
|
-
end
|
|
15
|
+
@encoder_klass = Encoders.lookup(encoding)
|
|
53
16
|
end
|
|
54
17
|
end
|
|
55
18
|
end
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module WebAuthn
|
|
4
|
+
def self.standard_encoder
|
|
5
|
+
@standard_encoder ||= Encoders.lookup(Encoder::STANDARD_ENCODING)
|
|
6
|
+
end
|
|
7
|
+
|
|
8
|
+
module Encoders
|
|
9
|
+
class << self
|
|
10
|
+
def lookup(encoding)
|
|
11
|
+
case encoding
|
|
12
|
+
when :base64
|
|
13
|
+
Base64Encoder
|
|
14
|
+
when :base64url
|
|
15
|
+
Base64UrlEncoder
|
|
16
|
+
when nil, false
|
|
17
|
+
NullEncoder
|
|
18
|
+
else
|
|
19
|
+
raise "Unsupported or unknown encoding: #{encoding}"
|
|
20
|
+
end
|
|
21
|
+
end
|
|
22
|
+
end
|
|
23
|
+
|
|
24
|
+
class Base64Encoder
|
|
25
|
+
def self.encode(data)
|
|
26
|
+
[data].pack("m0") # Base64.strict_encode64(data)
|
|
27
|
+
end
|
|
28
|
+
|
|
29
|
+
def self.decode(data)
|
|
30
|
+
data.unpack1("m0") # Base64.strict_decode64(data)
|
|
31
|
+
end
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
class Base64UrlEncoder
|
|
35
|
+
def self.encode(data)
|
|
36
|
+
data = [data].pack("m0") # Base64.urlsafe_encode64(data, padding: false)
|
|
37
|
+
data.chomp!("==") or data.chomp!("=")
|
|
38
|
+
data.tr!("+/", "-_")
|
|
39
|
+
data
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
def self.decode(data)
|
|
43
|
+
if !data.end_with?("=") && data.length % 4 != 0 # Base64.urlsafe_decode64(data)
|
|
44
|
+
data = data.ljust((data.length + 3) & ~3, "=")
|
|
45
|
+
end
|
|
46
|
+
|
|
47
|
+
data = data.tr("-_", "+/")
|
|
48
|
+
data.unpack1("m0")
|
|
49
|
+
end
|
|
50
|
+
end
|
|
51
|
+
|
|
52
|
+
class NullEncoder
|
|
53
|
+
def self.encode(data)
|
|
54
|
+
data
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
def self.decode(data)
|
|
58
|
+
data
|
|
59
|
+
end
|
|
60
|
+
end
|
|
61
|
+
end
|
|
62
|
+
end
|
|
@@ -43,7 +43,9 @@ module WebAuthn
|
|
|
43
43
|
end
|
|
44
44
|
|
|
45
45
|
def attestation_trust_path
|
|
46
|
-
@attestation_trust_path ||= [
|
|
46
|
+
@attestation_trust_path ||= [
|
|
47
|
+
OpenSSL::X509::Certificate.new(WebAuthn::Encoders::Base64Encoder.decode(@certificate))
|
|
48
|
+
]
|
|
47
49
|
end
|
|
48
50
|
|
|
49
51
|
private
|
|
@@ -51,14 +53,14 @@ module WebAuthn
|
|
|
51
53
|
# https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#u2f-authenticatorMakeCredential-interoperability
|
|
52
54
|
# Let credentialId be a credentialIdLength byte array initialized with CTAP1/U2F response key handle bytes.
|
|
53
55
|
def credential_id
|
|
54
|
-
|
|
56
|
+
WebAuthn::Encoders::Base64UrlEncoder.decode(@key_handle)
|
|
55
57
|
end
|
|
56
58
|
|
|
57
59
|
# Let x9encodedUserPublicKey be the user public key returned in the U2F registration response message [U2FRawMsgs].
|
|
58
60
|
# Let coseEncodedCredentialPublicKey be the result of converting x9encodedUserPublicKey’s value from ANS X9.62 /
|
|
59
61
|
# Sec-1 v2 uncompressed curve point representation [SEC1V2] to COSE_Key representation ([RFC8152] Section 7).
|
|
60
62
|
def credential_cose_key
|
|
61
|
-
decoded_public_key =
|
|
63
|
+
decoded_public_key = WebAuthn::Encoders::Base64Encoder.decode(@public_key)
|
|
62
64
|
if WebAuthn::AttestationStatement::FidoU2f::PublicKey.uncompressed_point?(decoded_public_key)
|
|
63
65
|
COSE::Key::EC2.new(
|
|
64
66
|
alg: COSE::Algorithm.by_name("ES256").id,
|
data/lib/webauthn/version.rb
CHANGED
data/webauthn.gemspec
CHANGED
|
@@ -38,15 +38,14 @@ Gem::Specification.new do |spec|
|
|
|
38
38
|
spec.add_dependency "cbor", "~> 0.5.9"
|
|
39
39
|
spec.add_dependency "cose", "~> 1.1"
|
|
40
40
|
spec.add_dependency "openssl", ">= 2.2"
|
|
41
|
-
spec.add_dependency "safety_net_attestation", "~> 0.
|
|
41
|
+
spec.add_dependency "safety_net_attestation", "~> 0.5.0"
|
|
42
42
|
spec.add_dependency "tpm-key_attestation", "~> 0.14.0"
|
|
43
43
|
|
|
44
|
-
spec.add_development_dependency "base64", ">= 0.1.0"
|
|
45
44
|
spec.add_development_dependency "bundler", ">= 1.17", "< 3.0"
|
|
46
45
|
spec.add_development_dependency "byebug", "~> 11.0"
|
|
47
46
|
spec.add_development_dependency "rake", "~> 13.0"
|
|
48
47
|
spec.add_development_dependency "rspec", "~> 3.8"
|
|
49
|
-
spec.add_development_dependency "rubocop", "~> 1
|
|
50
|
-
spec.add_development_dependency "rubocop-rake", "~> 0.5
|
|
51
|
-
spec.add_development_dependency "rubocop-rspec", "
|
|
48
|
+
spec.add_development_dependency "rubocop", "~> 1"
|
|
49
|
+
spec.add_development_dependency "rubocop-rake", "~> 0.5"
|
|
50
|
+
spec.add_development_dependency "rubocop-rspec", ">= 2.2", "< 4.0"
|
|
52
51
|
end
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: webauthn
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 3.4.
|
|
4
|
+
version: 3.4.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Gonzalo Rodriguez
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: exe
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2025-
|
|
12
|
+
date: 2025-09-23 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
15
|
name: android_key_attestation
|
|
@@ -87,14 +87,14 @@ dependencies:
|
|
|
87
87
|
requirements:
|
|
88
88
|
- - "~>"
|
|
89
89
|
- !ruby/object:Gem::Version
|
|
90
|
-
version: 0.
|
|
90
|
+
version: 0.5.0
|
|
91
91
|
type: :runtime
|
|
92
92
|
prerelease: false
|
|
93
93
|
version_requirements: !ruby/object:Gem::Requirement
|
|
94
94
|
requirements:
|
|
95
95
|
- - "~>"
|
|
96
96
|
- !ruby/object:Gem::Version
|
|
97
|
-
version: 0.
|
|
97
|
+
version: 0.5.0
|
|
98
98
|
- !ruby/object:Gem::Dependency
|
|
99
99
|
name: tpm-key_attestation
|
|
100
100
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -109,20 +109,6 @@ dependencies:
|
|
|
109
109
|
- - "~>"
|
|
110
110
|
- !ruby/object:Gem::Version
|
|
111
111
|
version: 0.14.0
|
|
112
|
-
- !ruby/object:Gem::Dependency
|
|
113
|
-
name: base64
|
|
114
|
-
requirement: !ruby/object:Gem::Requirement
|
|
115
|
-
requirements:
|
|
116
|
-
- - ">="
|
|
117
|
-
- !ruby/object:Gem::Version
|
|
118
|
-
version: 0.1.0
|
|
119
|
-
type: :development
|
|
120
|
-
prerelease: false
|
|
121
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
122
|
-
requirements:
|
|
123
|
-
- - ">="
|
|
124
|
-
- !ruby/object:Gem::Version
|
|
125
|
-
version: 0.1.0
|
|
126
112
|
- !ruby/object:Gem::Dependency
|
|
127
113
|
name: bundler
|
|
128
114
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -191,42 +177,48 @@ dependencies:
|
|
|
191
177
|
requirements:
|
|
192
178
|
- - "~>"
|
|
193
179
|
- !ruby/object:Gem::Version
|
|
194
|
-
version: 1
|
|
180
|
+
version: '1'
|
|
195
181
|
type: :development
|
|
196
182
|
prerelease: false
|
|
197
183
|
version_requirements: !ruby/object:Gem::Requirement
|
|
198
184
|
requirements:
|
|
199
185
|
- - "~>"
|
|
200
186
|
- !ruby/object:Gem::Version
|
|
201
|
-
version: 1
|
|
187
|
+
version: '1'
|
|
202
188
|
- !ruby/object:Gem::Dependency
|
|
203
189
|
name: rubocop-rake
|
|
204
190
|
requirement: !ruby/object:Gem::Requirement
|
|
205
191
|
requirements:
|
|
206
192
|
- - "~>"
|
|
207
193
|
- !ruby/object:Gem::Version
|
|
208
|
-
version: 0.5
|
|
194
|
+
version: '0.5'
|
|
209
195
|
type: :development
|
|
210
196
|
prerelease: false
|
|
211
197
|
version_requirements: !ruby/object:Gem::Requirement
|
|
212
198
|
requirements:
|
|
213
199
|
- - "~>"
|
|
214
200
|
- !ruby/object:Gem::Version
|
|
215
|
-
version: 0.5
|
|
201
|
+
version: '0.5'
|
|
216
202
|
- !ruby/object:Gem::Dependency
|
|
217
203
|
name: rubocop-rspec
|
|
218
204
|
requirement: !ruby/object:Gem::Requirement
|
|
219
205
|
requirements:
|
|
220
|
-
- - "
|
|
206
|
+
- - ">="
|
|
207
|
+
- !ruby/object:Gem::Version
|
|
208
|
+
version: '2.2'
|
|
209
|
+
- - "<"
|
|
221
210
|
- !ruby/object:Gem::Version
|
|
222
|
-
version:
|
|
211
|
+
version: '4.0'
|
|
223
212
|
type: :development
|
|
224
213
|
prerelease: false
|
|
225
214
|
version_requirements: !ruby/object:Gem::Requirement
|
|
226
215
|
requirements:
|
|
227
|
-
- - "
|
|
216
|
+
- - ">="
|
|
217
|
+
- !ruby/object:Gem::Version
|
|
218
|
+
version: '2.2'
|
|
219
|
+
- - "<"
|
|
228
220
|
- !ruby/object:Gem::Version
|
|
229
|
-
version:
|
|
221
|
+
version: '4.0'
|
|
230
222
|
description: |-
|
|
231
223
|
WebAuthn ruby server library ― Make your application a W3C Web Authentication conformant
|
|
232
224
|
Relying Party and allow your users to authenticate with U2F and FIDO2 authenticators.
|
|
@@ -237,6 +229,8 @@ executables: []
|
|
|
237
229
|
extensions: []
|
|
238
230
|
extra_rdoc_files: []
|
|
239
231
|
files:
|
|
232
|
+
- ".github/actions/install-openssl/action.yml"
|
|
233
|
+
- ".github/actions/install-ruby/action.yml"
|
|
240
234
|
- ".github/dependabot.yml"
|
|
241
235
|
- ".github/workflows/build.yml"
|
|
242
236
|
- ".github/workflows/git.yml"
|
|
@@ -282,6 +276,7 @@ files:
|
|
|
282
276
|
- lib/webauthn/credential_rp_entity.rb
|
|
283
277
|
- lib/webauthn/credential_user_entity.rb
|
|
284
278
|
- lib/webauthn/encoder.rb
|
|
279
|
+
- lib/webauthn/encoders.rb
|
|
285
280
|
- lib/webauthn/error.rb
|
|
286
281
|
- lib/webauthn/fake_authenticator.rb
|
|
287
282
|
- lib/webauthn/fake_authenticator/attestation_object.rb
|
|
@@ -324,7 +319,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
324
319
|
- !ruby/object:Gem::Version
|
|
325
320
|
version: '0'
|
|
326
321
|
requirements: []
|
|
327
|
-
rubygems_version: 3.
|
|
322
|
+
rubygems_version: 3.2.1
|
|
328
323
|
signing_key:
|
|
329
324
|
specification_version: 4
|
|
330
325
|
summary: WebAuthn ruby server library
|