webauthn 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d6d2e58280b0751e346931762bbd6985f7ac0c89dc7a2ac98ae4658e98b6f68c
-  data.tar.gz: ca2ee35c669f2a31dd7770212deef3712b3089f34e119124977eac70f91cc3d7
+  metadata.gz: ae88f2e29c3d4c734f5d7efec59b6dd3824a2976a10c5cb7bc03ff525d79852c
+  data.tar.gz: b62bcde957604db6eb660ccd515c66bdb894178a3e6173a783483a0ee0378ac2
 SHA512:
-  metadata.gz: df657808c9a692d6f32b1256917dfb9867abd9fa6dc117059cb92f1d8cb80beb652af7d71b9881add353b20a8dad85cd00448ed8d6a9205070ed6d627882ea58
-  data.tar.gz: 9d417117edd82f9072dad0a98fafe4707121e2fb3cfb62678195e324d9bb68e1f00c35dbe8fc1721abd34ec1d09259decf2c620b4e56af2638cf3ec6ec98e850
+  metadata.gz: 6b40ec846092c70e19e79656325e24f1ed43231b911b37fe3fb9be20afbcd276b8d1e46f2e3bd719c92f0f031738f364581514db542c981028369ffbca28afe3
+  data.tar.gz: dd26ac18ca8db8ae98007a9f566e521a7d24998f244583099ff7f7bac4a8776d5ab2fa8f76fc2f2c8d7291d3119b21efcb422d46ee892dea6e83045c51b85878

data/CHANGELOG.md

@@ -1,13 +1,24 @@
 # Changelog
 
+## [v1.2.0] - 2018-10-08
+
+### Added
+
+- _Registration_ ceremony
+  - `WebAuthn::AuthenticatorAttestationResponse.valid?` returns `true` if either UP or UV authenticator flags are present.
+- _Authentication_ ceremony
+  - `WebAuthn::AuthenticatorAssertionResponse.valid?` returns `true` if either UP or UV authenticator flags are present.
+
+Note: Both additions should help making it compatible with Chrome for Android 70+/Android Fingerprint pair.
+
 ## [v1.1.0] - 2018-10-04
 
-## Added
+### Added
 
 - _Registration_ ceremony
-  - `WebAuthn::AuthenticatorAttestationResponse.valid?` optionaly accepts rp_id. Thank you @sorah!
+  - `WebAuthn::AuthenticatorAttestationResponse.valid?` optionally accepts rp_id. Thank you @sorah!
 - _Authentication_ ceremony
-  - `WebAuthn::AuthenticatorAssertionResponse.valid?` optionaly accepts rp_id.
+  - `WebAuthn::AuthenticatorAssertionResponse.valid?` optionally accepts rp_id.
 
 ## [v1.0.0] - 2018-09-07
 
@@ -60,6 +71,7 @@
   - `WebAuthn::AuthenticatorAttestationResponse.valid?` can be used to validate fido-u2f attestations returned by the browser
 - Works with ruby 2.5
 
+[v1.2.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.1.0...v1.2.0/
 [v1.1.0]: https://github.com/cedarcode/webauthn-ruby/compare/v1.0.0...v1.1.0/
 [v1.0.0]: https://github.com/cedarcode/webauthn-ruby/compare/v0.2.0...v1.0.0/
 [v0.2.0]: https://github.com/cedarcode/webauthn-ruby/compare/v0.1.0...v0.2.0/

data/README.md

@@ -68,8 +68,17 @@ credential_creation_options[:challenge]
 #### Validation phase
 
 ```ruby
-attestation_object = "..." # As returned by `navigator.credentials.create`
-client_data_json = "..." # As returned by `navigator.credentials.create`
+# These should be ruby `String`s encoded as binary data, e.g. `Encoding:ASCII-8BIT`.
+#
+# If the user-agent is a web browser, you would use some encoding algorithm to send what
+# `navigator.credentials.create` returned through the wire.
+#
+# Then you need to decode that data before passing it to the `#valid?` method.
+#
+# E.g. in https://github.com/cedarcode/webauthn-rails-demo-app we use `Base64.strict_decode64`
+# on the user-agent encoded data before calling `#valid`
+attestation_object = "..."
+client_data_json = "..."
 
 attestation_response = WebAuthn::AuthenticatorAttestationResponse.new(
   attestation_object: attestation_object,
@@ -117,9 +126,18 @@ credential_request_options[:challenge]
 Assuming you have the previously stored Credential Public Key, now in variable `credential_public_key`
 
 ```ruby
-authenticator_data = "..." # As returned by `navigator.credentials.get`
-client_data_json = "..." # As returned by `navigator.credentials.get`
-signature = "..." # As returned by `navigator.credentials.get`
+# These should be ruby `String`s encoded as binary data, e.g. `Encoding:ASCII-8BIT`.
+#
+# If the user-agent is a web browser, you would use some encoding algorithm to send what
+# `navigator.credentials.get` returned through the wire.
+#
+# Then you need to decode that data before passing it to the `#valid?` method.
+#
+# E.g. in https://github.com/cedarcode/webauthn-rails-demo-app we use `Base64.strict_decode64`
+# on the user-agent encoded data before calling `#valid`
+authenticator_data = "..."
+client_data_json = "..."
+signature = "..."
 
 assertion_response = WebAuthn::AuthenticatorAssertionResponse.new(
   authenticator_data: authenticator_data,

data/lib/webauthn/authenticator_data.rb

@@ -13,6 +13,7 @@ module WebAuthn
     SIGN_COUNT_POSITION = RP_ID_HASH_LENGTH + FLAGS_LENGTH
 
     USER_PRESENT_FLAG_POSITION = 0
+    USER_VERIFIED_FLAG_POSITION = 2
     ATTESTED_CREDENTIAL_DATA_INCLUDED_FLAG_POSITION = 6
 
     def initialize(data)
@@ -29,10 +30,18 @@ module WebAuthn
       end
     end
 
+    def user_flagged?
+      user_present? || user_verified?
+    end
+
     def user_present?
       flags[USER_PRESENT_FLAG_POSITION] == "1"
     end
 
+    def user_verified?
+      flags[USER_VERIFIED_FLAG_POSITION] == "1"
+    end
+
     def attested_credential_data_included?
       flags[ATTESTED_CREDENTIAL_DATA_INCLUDED_FLAG_POSITION] == "1"
     end

data/lib/webauthn/authenticator_response.rb

@@ -12,7 +12,7 @@ module WebAuthn
         valid_origin?(original_origin) &&
         valid_rp_id?(rp_id || rp_id_from_origin(original_origin)) &&
         authenticator_data.valid? &&
-        authenticator_data.user_present?
+        authenticator_data.user_flagged?
     end
 
     def client_data

data/lib/webauthn/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WebAuthn
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: webauthn
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Gonzalo Rodriguez
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-10-05 00:00:00.000000000 Z
+date: 2018-10-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cbor
@@ -167,7 +167,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.7.7
 signing_key: 
 specification_version: 4
 summary: WebAuthn in ruby ― Ruby implementation of a WebAuthn Relying Party