webauthn 3.4.1 → 3.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/actions/install-openssl/action.yml +55 -0
- data/.github/actions/install-ruby/action.yml +84 -0
- data/.github/workflows/build.yml +40 -8
- data/.github/workflows/git.yml +1 -1
- data/.rubocop.yml +1 -1
- data/CHANGELOG.md +7 -0
- data/README.md +2 -2
- data/docs/advanced_configuration.md +10 -9
- data/lib/webauthn/version.rb +1 -1
- data/webauthn.gemspec +1 -1
- metadata +7 -5
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 50b5c2c43f3e5719dd1ed0f63e9a7bb9705f2f1e97861ab0a0ee0a7d61c4ee41
|
4
|
+
data.tar.gz: d8849b387d30e54f7a45fd66bcb2b164983100b0b3369ca8fbf52840261e7fe4
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 4189cd8d89340585a464e6d9368b6ea532c7c59189cbd47022a04d767ec230979076652e333e70878dcead127688d7fe01e57706f63afe325eb1ec5673cf851a
|
7
|
+
data.tar.gz: 1cba3b28cd9388256f6d47493fb151f7732ad8680da5863476d4b5e237db7389e362f7a2543bc1447cd0e205e44134957cfa2e4ceb43e9fb32a6b5f851ff349a
|
@@ -0,0 +1,55 @@
|
|
1
|
+
name: Install OpenSSL
|
2
|
+
|
3
|
+
inputs:
|
4
|
+
version:
|
5
|
+
description: 'The version of OpenSSL to install'
|
6
|
+
required: true
|
7
|
+
|
8
|
+
runs:
|
9
|
+
using: 'composite'
|
10
|
+
steps:
|
11
|
+
- name: Restore cached OpenSSL library
|
12
|
+
id: cache-openssl-restore
|
13
|
+
uses: actions/cache/restore@v4
|
14
|
+
with:
|
15
|
+
path: ~/openssl
|
16
|
+
key: openssl-${{ inputs.version }}
|
17
|
+
|
18
|
+
- name: Compile OpenSSL library
|
19
|
+
if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
|
20
|
+
shell: bash
|
21
|
+
run: |
|
22
|
+
mkdir -p tmp/build-openssl && cd tmp/build-openssl
|
23
|
+
case ${{ inputs.version }} in
|
24
|
+
1.1.*)
|
25
|
+
OPENSSL_COMMIT=OpenSSL_
|
26
|
+
OPENSSL_COMMIT+=$(echo ${{ inputs.version }} | sed -e 's/\./_/g')
|
27
|
+
git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
|
28
|
+
echo "Git commit: $(git rev-parse HEAD)"
|
29
|
+
./Configure --prefix=$HOME/openssl --libdir=lib linux-x86_64
|
30
|
+
make depend && make -j4 && make install_sw
|
31
|
+
;;
|
32
|
+
3.*)
|
33
|
+
OPENSSL_COMMIT=openssl-
|
34
|
+
OPENSSL_COMMIT+=$(echo ${{ inputs.version }})
|
35
|
+
git clone -b $OPENSSL_COMMIT --depth 1 https://github.com/openssl/openssl.git .
|
36
|
+
echo "Git commit: $(git rev-parse HEAD)"
|
37
|
+
if [[ ${{ inputs.version }} == 3.5* ]]; then
|
38
|
+
./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests no-legacy
|
39
|
+
else
|
40
|
+
./Configure --prefix=$HOME/openssl --libdir=lib enable-fips no-tests
|
41
|
+
fi
|
42
|
+
make -j4 && make install_sw && make install_fips
|
43
|
+
;;
|
44
|
+
*)
|
45
|
+
echo "Don't know how to build OpenSSL ${{ inputs.version }}"
|
46
|
+
;;
|
47
|
+
esac
|
48
|
+
|
49
|
+
- name: Save OpenSSL library cache
|
50
|
+
if: steps.cache-openssl-restore.outputs.cache-hit != 'true'
|
51
|
+
id: cache-openssl-save
|
52
|
+
uses: actions/cache/save@v4
|
53
|
+
with:
|
54
|
+
path: ~/openssl
|
55
|
+
key: ${{ steps.cache-openssl-restore.outputs.cache-primary-key }}
|
@@ -0,0 +1,84 @@
|
|
1
|
+
name: Install Ruby
|
2
|
+
|
3
|
+
inputs:
|
4
|
+
version:
|
5
|
+
description: 'The version of Ruby to install'
|
6
|
+
required: true
|
7
|
+
openssl-version:
|
8
|
+
description: 'The version of OpenSSL used'
|
9
|
+
required: true
|
10
|
+
|
11
|
+
runs:
|
12
|
+
using: 'composite'
|
13
|
+
steps:
|
14
|
+
- name: Restore cached Ruby installation
|
15
|
+
id: cache-ruby-restore
|
16
|
+
uses: actions/cache/restore@v4
|
17
|
+
with:
|
18
|
+
path: ~/rubies/ruby-${{ inputs.version }}
|
19
|
+
key: ruby-${{ inputs.version }}-with-openssl-${{ inputs.openssl-version }}
|
20
|
+
|
21
|
+
- name: Install Ruby
|
22
|
+
if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
|
23
|
+
shell: bash
|
24
|
+
run: |
|
25
|
+
latest_patch=$(curl -s https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ \
|
26
|
+
| grep -oP "ruby-${{ inputs.version }}\.\d+\.tar\.xz" \
|
27
|
+
| grep -oP "\d+(?=\.tar\.xz)" \
|
28
|
+
| sort -V | tail -n 1)
|
29
|
+
wget https://cache.ruby-lang.org/pub/ruby/${{ inputs.version }}/ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
30
|
+
tar -xJvf ruby-${{ inputs.version }}.${latest_patch}.tar.xz
|
31
|
+
cd ruby-${{ inputs.version }}.${latest_patch}
|
32
|
+
./configure --prefix=$HOME/rubies/ruby-${{ inputs.version }} --with-openssl-dir=$HOME/openssl
|
33
|
+
make
|
34
|
+
make install
|
35
|
+
|
36
|
+
- name: Update PATH
|
37
|
+
shell: bash
|
38
|
+
run: |
|
39
|
+
echo "~/rubies/ruby-${{ inputs.version }}/bin" >> $GITHUB_PATH
|
40
|
+
|
41
|
+
- name: Install Bundler
|
42
|
+
shell: bash
|
43
|
+
run: |
|
44
|
+
case ${{ inputs.version }} in
|
45
|
+
2.7* | 3.*)
|
46
|
+
echo "Skipping Bundler installation for Ruby ${{ inputs.version }}"
|
47
|
+
;;
|
48
|
+
2.5* | 2.6*)
|
49
|
+
gem install bundler -v '~> 2.3.0'
|
50
|
+
;;
|
51
|
+
*)
|
52
|
+
echo "Don't know how to install Bundler for Ruby ${{ inputs.version }}"
|
53
|
+
;;
|
54
|
+
esac
|
55
|
+
|
56
|
+
- name: Save Ruby installation cache
|
57
|
+
if: steps.cache-ruby-restore.outputs.cache-hit != 'true'
|
58
|
+
id: cache-ruby-save
|
59
|
+
uses: actions/cache/save@v4
|
60
|
+
with:
|
61
|
+
path: ~/rubies/ruby-${{ inputs.version }}
|
62
|
+
key: ${{ steps.cache-ruby-restore.outputs.cache-primary-key }}
|
63
|
+
|
64
|
+
- name: Cache Bundler Install
|
65
|
+
id: cache-bundler-restore
|
66
|
+
uses: actions/cache/restore@v4
|
67
|
+
env:
|
68
|
+
GEMFILE: ${{ env.BUNDLE_GEMFILE || 'Gemfile' }}
|
69
|
+
with:
|
70
|
+
path: ~/bundler/cache
|
71
|
+
key: bundler-ruby-${{ inputs.version }}-${{ inputs.openssl-version }}-${{ hashFiles(env.Gemfile, 'webauthn.gemspec') }}
|
72
|
+
|
73
|
+
- name: Install dependencies
|
74
|
+
shell: bash
|
75
|
+
run: |
|
76
|
+
bundle config set --local path ~/bundler/cache
|
77
|
+
bundle install
|
78
|
+
|
79
|
+
- name: Save Bundler Install cache
|
80
|
+
id: cache-bundler-save
|
81
|
+
uses: actions/cache/save@v4
|
82
|
+
with:
|
83
|
+
path: ~/bundler/cache
|
84
|
+
key: ${{ steps.cache-bundler-restore.outputs.cache-primary-key }}
|
data/.github/workflows/build.yml
CHANGED
@@ -15,6 +15,7 @@ on:
|
|
15
15
|
|
16
16
|
jobs:
|
17
17
|
test:
|
18
|
+
name: 'Test Ruby ${{ matrix.ruby }} with OpenSSL ${{ matrix.openssl }}'
|
18
19
|
runs-on: ubuntu-24.04
|
19
20
|
strategy:
|
20
21
|
fail-fast: false
|
@@ -24,17 +25,48 @@ jobs:
|
|
24
25
|
- '3.3'
|
25
26
|
- '3.2'
|
26
27
|
- '3.1'
|
27
|
-
|
28
|
-
- '
|
29
|
-
- '2
|
30
|
-
- '
|
31
|
-
-
|
28
|
+
openssl:
|
29
|
+
- '3.5.3'
|
30
|
+
- '3.4.2'
|
31
|
+
- '3.3.4'
|
32
|
+
- '3.2.5'
|
33
|
+
- '3.1.8'
|
34
|
+
- '3.0.17'
|
35
|
+
- '1.1.1w'
|
36
|
+
include:
|
37
|
+
- ruby: truffleruby
|
38
|
+
- ruby: '3.0'
|
39
|
+
openssl: '1.1.1w'
|
40
|
+
- ruby: '2.7'
|
41
|
+
openssl: '1.1.1w'
|
42
|
+
- ruby: '2.6'
|
43
|
+
openssl: '1.1.1w'
|
44
|
+
- ruby: '2.5'
|
45
|
+
openssl: '1.1.1w'
|
46
|
+
|
32
47
|
steps:
|
33
|
-
- uses: actions/checkout@
|
34
|
-
|
48
|
+
- uses: actions/checkout@v5
|
49
|
+
|
50
|
+
- name: Install OpenSSL
|
51
|
+
if: matrix.ruby != 'truffleruby'
|
52
|
+
uses: ./.github/actions/install-openssl
|
53
|
+
with:
|
54
|
+
version: ${{ matrix.openssl }}
|
55
|
+
|
56
|
+
- name: Manually set up Ruby
|
57
|
+
if: matrix.ruby != 'truffleruby'
|
58
|
+
uses: ./.github/actions/install-ruby
|
59
|
+
with:
|
60
|
+
version: ${{ matrix.ruby }}
|
61
|
+
openssl-version: ${{ matrix.openssl }}
|
62
|
+
|
63
|
+
- name: Set up Ruby
|
64
|
+
if: matrix.ruby == 'truffleruby'
|
65
|
+
uses: ruby/setup-ruby@v1
|
35
66
|
with:
|
36
67
|
ruby-version: ${{ matrix.ruby }}
|
37
68
|
bundler-cache: true
|
69
|
+
|
38
70
|
- run: bundle exec rspec
|
39
71
|
env:
|
40
72
|
RUBYOPT: ${{ startsWith(matrix.ruby, '3.4') && '--enable=frozen-string-literal' || '' }}
|
@@ -42,7 +74,7 @@ jobs:
|
|
42
74
|
lint:
|
43
75
|
runs-on: ubuntu-latest
|
44
76
|
steps:
|
45
|
-
- uses: actions/checkout@
|
77
|
+
- uses: actions/checkout@v5
|
46
78
|
- uses: ruby/setup-ruby@v1
|
47
79
|
with:
|
48
80
|
ruby-version: '3.3'
|
data/.github/workflows/git.yml
CHANGED
data/.rubocop.yml
CHANGED
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,11 @@
|
|
1
1
|
# Changelog
|
2
2
|
|
3
|
+
## [v3.4.2] - 2025-09-22
|
4
|
+
|
5
|
+
### Added
|
6
|
+
|
7
|
+
- Updated `safety_net_attestation` dependency from `~> 0.4.0` to `~> 0.5.0`.
|
8
|
+
|
3
9
|
## [v3.4.1] - 2025-06-06
|
4
10
|
|
5
11
|
- Avoid requiring `base64` as it's not a direct dependency. [#459](https://github.com/cedarcode/webauthn-ruby/pull/459)[@santiagorodriguez96]
|
@@ -421,6 +427,7 @@ Note: Both additions should help making it compatible with Chrome for Android 70
|
|
421
427
|
- `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
|
422
428
|
- Works with ruby 2.5
|
423
429
|
|
430
|
+
[v3.4.2]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.1...v3.4.2/
|
424
431
|
[v3.4.1]: https://github.com/cedarcode/webauthn-ruby/compare/v3.4.0...v3.4.1/
|
425
432
|
[v3.4.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.3.0...v3.4.0/
|
426
433
|
[v3.3.0]: https://github.com/cedarcode/webauthn-ruby/compare/v3.2.2...v3.3.0/
|
data/README.md
CHANGED
@@ -1,5 +1,5 @@
|
|
1
|
-
|
2
|
-
For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/
|
1
|
+
> [!warning]
|
2
|
+
> You are viewing the README for the development version of webauthn-ruby. For the current release version see https://github.com/cedarcode/webauthn-ruby/blob/3-stable/README.md.
|
3
3
|
|
4
4
|
# webauthn-ruby
|
5
5
|
|
@@ -4,24 +4,25 @@
|
|
4
4
|
|
5
5
|
Which approach suits best your needs will depend on the architecture of your application and how do your users need to register and authenticate to it.
|
6
6
|
|
7
|
-
If you have a multi-tenant application, or any application
|
7
|
+
If you have a multi-tenant application, or any application segmentation, where your users register and authenticate to each of these tenants or segments individually using different hostnames, or with different security needs, you need to go through [Instance Based Configuration](#instance-based-configuration).
|
8
8
|
|
9
|
-
However, if your application is served for just one hostname, or else if your users authenticate to only one
|
9
|
+
However, if your application is served for just one hostname, or else if your users authenticate to only one subdomain (e.g. your application serves www.example.com and admin.example.com but all your users authenticate through auth.example.com) you can still rely on one [Global Configuration](../README.md#configuration).
|
10
10
|
|
11
11
|
If you are still not sure, or want to keep your options open, be aware that [Instance Based Configuration](#instance-based-configuration) is also a valid way of defining a single instance configuration and how you share such configuration across your application, it's up to you.
|
12
12
|
|
13
13
|
|
14
14
|
## Instance Based Configuration
|
15
15
|
|
16
|
-
|
16
|
+
Instead of the [Global Configuration](../README.md#configuration) you place in `config/initializers/webauthn.rb`,
|
17
17
|
you can now have an on-demand instance of `WebAuthn::RelyingParty` with the same configuration options, that
|
18
|
-
you can build anywhere in
|
18
|
+
you can build anywhere in your application, in the following way:
|
19
19
|
|
20
20
|
```ruby
|
21
21
|
relying_party = WebAuthn::RelyingParty.new(
|
22
22
|
# This value needs to match `window.location.origin` evaluated by
|
23
23
|
# the User Agent during registration and authentication ceremonies.
|
24
|
-
origin
|
24
|
+
# Multiple origins can be used when needed. Using more than one will imply you MUST configure rp_id explicitely. If you need your credentials to be bound to a single origin but you have more than one tenant, please see [our Advanced Configuration section](https://github.com/cedarcode/webauthn-ruby/blob/master/docs/advanced_configuration.md) instead of adding multiple origins.
|
25
|
+
allowed_origins: ["https://admin.example.com"],
|
25
26
|
|
26
27
|
# Relying Party name for display purposes
|
27
28
|
name: "Admin Site for Example Inc."
|
@@ -57,7 +58,7 @@ Intead of the [Global Configuration](../README.md#configuration) you place in `c
|
|
57
58
|
|
58
59
|
## Instance Based API
|
59
60
|
|
60
|
-
**DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been
|
61
|
+
**DISCLAIMER: This API was released on version 3.0.0.alpha1 and is still under evaluation. Although it has been thoroughly tested and it is fully functional it might be changed until the final release of version 3.0.0.**
|
61
62
|
|
62
63
|
The explanation for each ceremony can be found in depth in [Credential Registration](../README.md#credential-registration) and [Credential Authentication](../README.md#credential-authentication) but if you choose this instance based approach to define your WebAuthn configurations and assuming `relying_party` is the result of an instance you get through `WebAuthn::RelyingParty.new(...)` the code in those explanations needs to be updated to:
|
63
64
|
|
@@ -101,7 +102,7 @@ session[:creation_challenge] = options.challenge
|
|
101
102
|
begin
|
102
103
|
webauthn_credential = relying_party.verify_registration(
|
103
104
|
params[:publicKeyCredential],
|
104
|
-
|
105
|
+
session[:creation_challenge]
|
105
106
|
)
|
106
107
|
|
107
108
|
# Store Credential ID, Credential Public Key and Sign Count for future authentications
|
@@ -159,7 +160,7 @@ begin
|
|
159
160
|
# Continue with successful sign in or 2FA verification...
|
160
161
|
|
161
162
|
rescue WebAuthn::SignCountVerificationError => e
|
162
|
-
# Cryptographic verification of the authenticator data succeeded, but the signature counter was less
|
163
|
+
# Cryptographic verification of the authenticator data succeeded, but the signature counter was less than or equal
|
163
164
|
# to the stored value. This can have several reasons and depending on your risk tolerance you can choose to fail or
|
164
165
|
# pass authentication. For more information see https://www.w3.org/TR/webauthn/#sign-counter
|
165
166
|
rescue WebAuthn::Error => e
|
@@ -171,4 +172,4 @@ end
|
|
171
172
|
|
172
173
|
Adding a configuration for a new instance does not mean you need to get rid of your Global configuration. They can co-exist in your application and be both available for the different usages you might have. `WebAuthn.configuration.relying_party` will always return the global one while `WebAuthn::RelyingParty.new`, executed anywhere in your codebase, will allow you to create a different instance as you see the need. They will not collide and instead operate in isolation without any shared state.
|
173
174
|
|
174
|
-
The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is
|
175
|
+
The gem API described in the current [Usage](../README.md#usage) section for the [Global Configuration](../README.md#configuration) approach will still be valid but the [Instance Based API](#instance-based-api) also works with the global `relying_party` that is maintained globally at `WebAuthn.configuration.relying_party`.
|
data/lib/webauthn/version.rb
CHANGED
data/webauthn.gemspec
CHANGED
@@ -38,7 +38,7 @@ Gem::Specification.new do |spec|
|
|
38
38
|
spec.add_dependency "cbor", "~> 0.5.9"
|
39
39
|
spec.add_dependency "cose", "~> 1.1"
|
40
40
|
spec.add_dependency "openssl", ">= 2.2"
|
41
|
-
spec.add_dependency "safety_net_attestation", "~> 0.
|
41
|
+
spec.add_dependency "safety_net_attestation", "~> 0.5.0"
|
42
42
|
spec.add_dependency "tpm-key_attestation", "~> 0.14.0"
|
43
43
|
|
44
44
|
spec.add_development_dependency "bundler", ">= 1.17", "< 3.0"
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: webauthn
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 3.4.
|
4
|
+
version: 3.4.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Gonzalo Rodriguez
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: exe
|
11
11
|
cert_chain: []
|
12
|
-
date: 2025-
|
12
|
+
date: 2025-09-23 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: android_key_attestation
|
@@ -87,14 +87,14 @@ dependencies:
|
|
87
87
|
requirements:
|
88
88
|
- - "~>"
|
89
89
|
- !ruby/object:Gem::Version
|
90
|
-
version: 0.
|
90
|
+
version: 0.5.0
|
91
91
|
type: :runtime
|
92
92
|
prerelease: false
|
93
93
|
version_requirements: !ruby/object:Gem::Requirement
|
94
94
|
requirements:
|
95
95
|
- - "~>"
|
96
96
|
- !ruby/object:Gem::Version
|
97
|
-
version: 0.
|
97
|
+
version: 0.5.0
|
98
98
|
- !ruby/object:Gem::Dependency
|
99
99
|
name: tpm-key_attestation
|
100
100
|
requirement: !ruby/object:Gem::Requirement
|
@@ -229,6 +229,8 @@ executables: []
|
|
229
229
|
extensions: []
|
230
230
|
extra_rdoc_files: []
|
231
231
|
files:
|
232
|
+
- ".github/actions/install-openssl/action.yml"
|
233
|
+
- ".github/actions/install-ruby/action.yml"
|
232
234
|
- ".github/dependabot.yml"
|
233
235
|
- ".github/workflows/build.yml"
|
234
236
|
- ".github/workflows/git.yml"
|
@@ -317,7 +319,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
317
319
|
- !ruby/object:Gem::Version
|
318
320
|
version: '0'
|
319
321
|
requirements: []
|
320
|
-
rubygems_version: 3.
|
322
|
+
rubygems_version: 3.2.1
|
321
323
|
signing_key:
|
322
324
|
specification_version: 4
|
323
325
|
summary: WebAuthn ruby server library
|