@simplewebauthn/server 10.0.1 → 11.0.0

package/esm/authentication/verifyAuthenticationResponse.d.ts

@@ -1,11 +1,11 @@
-import type { AuthenticationResponseJSON, AuthenticatorDevice, Base64URLString, CredentialDeviceType, UserVerificationRequirement } from '../deps.js';
+import type { AuthenticationResponseJSON, Base64URLString, CredentialDeviceType, UserVerificationRequirement, WebAuthnCredential } from '../deps.js';
 import { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 export type VerifyAuthenticationResponseOpts = {
     response: AuthenticationResponseJSON;
     expectedChallenge: string | ((challenge: string) => boolean | Promise<boolean>);
     expectedOrigin: string | string[];
     expectedRPID: string | string[];
-    authenticator: AuthenticatorDevice;
+    credential: WebAuthnCredential;
     expectedType?: string | string[];
     requireUserVerification?: boolean;
     advancedFIDOConfig?: {
@@ -21,7 +21,7 @@ export type VerifyAuthenticationResponseOpts = {
  * @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
- * @param authenticator - An internal {@link AuthenticatorDevice} matching the credential's ID
+ * @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
  * @param expectedType **(Optional)** - The response type expected ('webauthn.get')
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements

package/esm/authentication/verifyAuthenticationResponse.js

@@ -14,14 +14,14 @@ import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
  * @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
- * @param authenticator - An internal {@link AuthenticatorDevice} matching the credential's ID
+ * @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
  * @param expectedType **(Optional)** - The response type expected ('webauthn.get')
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements
  * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
  */
 export async function verifyAuthenticationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, authenticator, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
     const { id, rawId, type: credentialType, response: assertionResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -141,24 +141,24 @@ export async function verifyAuthenticationResponse(options) {
     const clientDataHash = await toHash(isoBase64URL.toBuffer(assertionResponse.clientDataJSON));
     const signatureBase = isoUint8Array.concat([authDataBuffer, clientDataHash]);
     const signature = isoBase64URL.toBuffer(assertionResponse.signature);
-    if ((counter > 0 || authenticator.counter > 0) &&
-        counter <= authenticator.counter) {
+    if ((counter > 0 || credential.counter > 0) &&
+        counter <= credential.counter) {
         // Error out when the counter in the DB is greater than or equal to the counter in the
         // dataStruct. It's related to how the authenticator maintains the number of times its been
         // used for this client. If this happens, then someone's somehow increased the counter
         // on the device without going through this site
-        throw new Error(`Response counter value ${counter} was lower than expected ${authenticator.counter}`);
+        throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
     }
     const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
     const toReturn = {
         verified: await verifySignature({
             signature,
             data: signatureBase,
-            credentialPublicKey: authenticator.credentialPublicKey,
+            credentialPublicKey: credential.publicKey,
         }),
         authenticationInfo: {
             newCounter: counter,
-            credentialID: authenticator.credentialID,
+            credentialID: credential.id,
             userVerified: flags.uv,
             credentialDeviceType,
             credentialBackedUp,

package/esm/deps.d.ts

@@ -1,9 +1,9 @@
-export type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationResponseJSON, AuthenticatorDevice, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, Crypto, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, UserVerificationRequirement, } from '@simplewebauthn/types';
+export type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationResponseJSON, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, Crypto, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, UserVerificationRequirement, WebAuthnCredential, } from '@simplewebauthn/types';
 export * as tinyCbor from '@levischuck/tiny-cbor';
 export { default as base64 } from '@hexagon/base64';
 export { fetch as crossFetch } from 'cross-fetch';
-export { AsnParser, AsnSerializer } from '@peculiar/asn1-schema';
-export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
+export { AsnParser, AsnSerializer, OctetString } from '@peculiar/asn1-schema';
+export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, Extensions, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
 export { ECDSASigValue, ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1, } from '@peculiar/asn1-ecc';
 export { RSAPublicKey } from '@peculiar/asn1-rsa';
 export { id_ce_keyDescription, KeyDescription } from '@peculiar/asn1-android';

package/esm/deps.js

@@ -5,8 +5,8 @@ export { default as base64 } from '@hexagon/base64';
 // cross-fetch
 export { fetch as crossFetch } from 'cross-fetch';
 // @peculiar libraries
-export { AsnParser, AsnSerializer } from '@peculiar/asn1-schema';
-export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
+export { AsnParser, AsnSerializer, OctetString } from '@peculiar/asn1-schema';
+export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, Extensions, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
 export { ECDSASigValue, ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1, } from '@peculiar/asn1-ecc';
 export { RSAPublicKey } from '@peculiar/asn1-rsa';
 export { id_ce_keyDescription, KeyDescription } from '@peculiar/asn1-android';

package/esm/helpers/decodeAuthenticatorExtensions.d.ts

@@ -4,17 +4,7 @@
  * @param extensionData Authenticator Extension Data buffer
  */
 export declare function decodeAuthenticatorExtensions(extensionData: Uint8Array): AuthenticationExtensionsAuthenticatorOutputs | undefined;
-export type AuthenticationExtensionsAuthenticatorOutputs = {
-    devicePubKey?: DevicePublicKeyAuthenticatorOutput;
-    uvm?: UVMAuthenticatorOutput;
-};
-export type DevicePublicKeyAuthenticatorOutput = {
-    dpk?: Uint8Array;
-    sig?: string;
-    nonce?: Uint8Array;
-    scope?: Uint8Array;
-    aaguid?: Uint8Array;
-};
-export type UVMAuthenticatorOutput = {
-    uvm?: Uint8Array[];
-};
+/**
+ * Attempt to support authenticator extensions we might not know about in WebAuthn
+ */
+export type AuthenticationExtensionsAuthenticatorOutputs = unknown;

package/esm/helpers/validateExtFIDOGenCEAAGUID.d.ts

@@ -0,0 +1,6 @@
+import { Extensions } from '../deps.js';
+/**
+ * Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
+ * the attestation statement AAGUID.
+ */
+export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid: Uint8Array): boolean;

package/esm/helpers/validateExtFIDOGenCEAAGUID.js

@@ -0,0 +1,34 @@
+import { AsnParser, OctetString } from '../deps.js';
+import { isoUint8Array } from './iso/index.js';
+/**
+ * Attestation Certificate Extension OID: `id-fido-gen-ce-aaguid`
+ *
+ * Sourced from https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-key-attestation-v2.0-ps-20150904.html#verifying-an-attestation-statement
+ */
+const id_fido_gen_ce_aaguid = '1.3.6.1.4.1.45724.1.1.4';
+/**
+ * Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
+ * the attestation statement AAGUID.
+ */
+export function validateExtFIDOGenCEAAGUID(certExtensions, aaguid) {
+    // The certificate had no extensions so there's nothing to validate
+    if (!certExtensions) {
+        return true;
+    }
+    const extFIDOGenCEAAGUID = certExtensions.find((ext) => ext.extnID === id_fido_gen_ce_aaguid);
+    // The extension isn't present so there's nothing to validate
+    if (!extFIDOGenCEAAGUID) {
+        return true;
+    }
+    // Parse the extension value
+    const parsedExtFIDOGenCEAAGUID = AsnParser.parse(extFIDOGenCEAAGUID.extnValue, OctetString);
+    const extValue = new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);
+    // Compare the two values
+    const aaguidAndExtAreEqual = isoUint8Array.areEqual(aaguid, extValue);
+    if (!aaguidAndExtAreEqual) {
+        const _debugExtHex = isoUint8Array.toHex(extValue);
+        const _debugAAGUIDHex = isoUint8Array.toHex(aaguid);
+        throw new Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`);
+    }
+    return true;
+}

package/esm/registration/verifications/tpm/constants.js

@@ -109,6 +109,10 @@ export const TPM_MANUFACTURERS = {
         name: 'IBM',
         id: 'IBM',
     },
+    'id:49424D00': {
+        name: 'IBM',
+        id: 'IBM',
+    },
     'id:49465800': {
         name: 'Infineon',
         id: 'IFX',

package/esm/registration/verifications/tpm/verifyAttestationTPM.js

@@ -7,6 +7,7 @@ import { validateCertificatePath } from '../../../helpers/validateCertificatePat
 import { getCertificateInfo } from '../../../helpers/getCertificateInfo.js';
 import { verifySignature } from '../../../helpers/verifySignature.js';
 import { isoUint8Array } from '../../../helpers/iso/index.js';
+import { validateExtFIDOGenCEAAGUID } from '../../../helpers/validateExtFIDOGenCEAAGUID.js';
 import { MetadataService } from '../../../services/metadataService.js';
 import { verifyAttestationWithMetadata } from '../../../metadata/verifyAttestationWithMetadata.js';
 import { TPM_ECC_CURVE_COSE_CRV_MAP, TPM_MANUFACTURERS } from './constants.js';
@@ -206,8 +207,14 @@ export async function verifyAttestationTPM(options) {
     if (extKeyUsage[0] !== '2.23.133.8.3') {
         throw new Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);
     }
-    // TODO: If certificate contains id-fido-gen-ce-aaguid(1.3.6.1.4.1.45724.1.1.4) extension, check
-    // that it’s value is set to the same AAGUID as in authData.
+    // Validate attestation statement AAGUID against leaf cert AAGUID
+    try {
+        await validateExtFIDOGenCEAAGUID(parsedCert.tbsCertificate.extensions, aaguid);
+    }
+    catch (err) {
+        const _err = err;
+        throw new Error(`${_err.message} (TPM)`);
+    }
     // Run some metadata checks if a statement exists for this authenticator
     const statement = await MetadataService.getStatement(aaguid);
     if (statement) {

package/esm/registration/verifications/verifyAttestationPacked.js

@@ -4,6 +4,7 @@ import { validateCertificatePath } from '../../helpers/validateCertificatePath.j
 import { getCertificateInfo } from '../../helpers/getCertificateInfo.js';
 import { verifySignature } from '../../helpers/verifySignature.js';
 import { isoUint8Array } from '../../helpers/iso/index.js';
+import { validateExtFIDOGenCEAAGUID } from '../../helpers/validateExtFIDOGenCEAAGUID.js';
 import { MetadataService } from '../../services/metadataService.js';
 import { verifyAttestationWithMetadata } from '../../metadata/verifyAttestationWithMetadata.js';
 /**
@@ -26,7 +27,7 @@ export async function verifyAttestationPacked(options) {
     const signatureBase = isoUint8Array.concat([authData, clientDataHash]);
     let verified = false;
     if (x5c) {
-        const { subject, basicConstraintsCA, version, notBefore, notAfter } = getCertificateInfo(x5c[0]);
+        const { subject, basicConstraintsCA, version, notBefore, notAfter, parsedCertificate, } = getCertificateInfo(x5c[0]);
         const { OU, CN, O, C } = subject;
         if (OU !== 'Authenticator Attestation') {
             throw new Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');
@@ -54,8 +55,14 @@ export async function verifyAttestationPacked(options) {
         if (notAfter < now) {
             throw new Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);
         }
-        // TODO: If certificate contains id-fido-gen-ce-aaguid(1.3.6.1.4.1.45724.1.1.4) extension, check
-        // that it’s value is set to the same AAGUID as in authData.
+        // Validate attestation statement AAGUID against leaf cert AAGUID
+        try {
+            await validateExtFIDOGenCEAAGUID(parsedCertificate.tbsCertificate.extensions, aaguid);
+        }
+        catch (err) {
+            const _err = err;
+            throw new Error(`${_err.message} (Packed|Full)`);
+        }
         // If available, validate attestation alg and x5c with info in the metadata statement
         const statement = await MetadataService.getStatement(aaguid);
         if (statement) {

package/esm/registration/verifyRegistrationResponse.d.ts

@@ -1,4 +1,4 @@
-import type { Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON } from '../deps.js';
+import type { COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON, WebAuthnCredential } from '../deps.js';
 import { AttestationFormat, AttestationStatement } from '../helpers/decodeAttestationObject.js';
 import { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 export type VerifyRegistrationResponseOpts = {
@@ -7,6 +7,7 @@ export type VerifyRegistrationResponseOpts = {
     expectedOrigin: string | string[];
     expectedRPID?: string | string[];
     expectedType?: string | string[];
+    requireUserPresence?: boolean;
     requireUserVerification?: boolean;
     supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
 };
@@ -20,6 +21,7 @@ export type VerifyRegistrationResponseOpts = {
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
+ * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
  */
@@ -54,10 +56,8 @@ export type VerifiedRegistrationResponse = {
     verified: boolean;
     registrationInfo?: {
         fmt: AttestationFormat;
-        counter: number;
         aaguid: string;
-        credentialID: Base64URLString;
-        credentialPublicKey: Uint8Array;
+        credential: WebAuthnCredential;
         credentialType: 'public-key';
         attestationObject: Uint8Array;
         userVerified: boolean;

package/esm/registration/verifyRegistrationResponse.js

@@ -26,11 +26,12 @@ import { verifyAttestationApple } from './verifications/verifyAttestationApple.j
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
+ * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
  */
 export async function verifyRegistrationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserVerification = true, supportedAlgorithmIDs = supportedCOSEAlgorithmIdentifiers, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = supportedCOSEAlgorithmIdentifiers, } = options;
     const { id, rawId, type: credentialType, response: attestationResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -109,12 +110,12 @@ export async function verifyRegistrationResponse(options) {
         matchedRPID = await matchExpectedRPID(rpIdHash, expectedRPIDs);
     }
     // Make sure someone was physically present
-    if (!flags.up) {
-        throw new Error('User not present during registration');
+    if (requireUserPresence && !flags.up) {
+        throw new Error('User presence was required, but user was not present');
     }
     // Enforce user verification if specified
     if (requireUserVerification && !flags.uv) {
-        throw new Error('User verification required, but user could not be verified');
+        throw new Error('User verification was required, but user could not be verified');
     }
     if (!credentialID) {
         throw new Error('No credential ID was provided by authenticator');
@@ -189,11 +190,14 @@ export async function verifyRegistrationResponse(options) {
         const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
         toReturn.registrationInfo = {
             fmt,
-            counter,
             aaguid: convertAAGUIDToString(aaguid),
-            credentialID: isoBase64URL.fromBuffer(credentialID),
-            credentialPublicKey,
             credentialType,
+            credential: {
+                id: isoBase64URL.fromBuffer(credentialID),
+                publicKey: credentialPublicKey,
+                counter,
+                transports: response.response.transports,
+            },
             attestationObject,
             userVerified: flags.uv,
             credentialDeviceType,

package/package.json

@@ -2,7 +2,7 @@
   "module": "./esm/index.js",
   "main": "./script/index.js",
   "name": "@simplewebauthn/server",
-  "version": "10.0.1",
+  "version": "11.0.0",
   "description": "SimpleWebAuthn for Servers",
   "license": "MIT",
   "author": "Matthew Miller <matthew@millerti.me>",
@@ -56,7 +56,7 @@
     "@peculiar/asn1-rsa": "^2.3.8",
     "@peculiar/asn1-schema": "^2.3.8",
     "@peculiar/asn1-x509": "^2.3.8",
-    "@simplewebauthn/types": "^10.0.0",
+    "@simplewebauthn/types": "^11.0.0",
     "cross-fetch": "^4.0.0"
   },
   "devDependencies": {

package/script/authentication/verifyAuthenticationResponse.d.ts

@@ -1,11 +1,11 @@
-import type { AuthenticationResponseJSON, AuthenticatorDevice, Base64URLString, CredentialDeviceType, UserVerificationRequirement } from '../deps.js';
+import type { AuthenticationResponseJSON, Base64URLString, CredentialDeviceType, UserVerificationRequirement, WebAuthnCredential } from '../deps.js';
 import { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 export type VerifyAuthenticationResponseOpts = {
     response: AuthenticationResponseJSON;
     expectedChallenge: string | ((challenge: string) => boolean | Promise<boolean>);
     expectedOrigin: string | string[];
     expectedRPID: string | string[];
-    authenticator: AuthenticatorDevice;
+    credential: WebAuthnCredential;
     expectedType?: string | string[];
     requireUserVerification?: boolean;
     advancedFIDOConfig?: {
@@ -21,7 +21,7 @@ export type VerifyAuthenticationResponseOpts = {
  * @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
- * @param authenticator - An internal {@link AuthenticatorDevice} matching the credential's ID
+ * @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
  * @param expectedType **(Optional)** - The response type expected ('webauthn.get')
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements

package/script/authentication/verifyAuthenticationResponse.js

@@ -17,14 +17,14 @@ const index_js_1 = require("../helpers/iso/index.js");
  * @param expectedChallenge - The base64url-encoded `options.challenge` returned by `generateAuthenticationOptions()`
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
- * @param authenticator - An internal {@link AuthenticatorDevice} matching the credential's ID
+ * @param credential - An internal {@link WebAuthnCredential} corresponding to `id` in the authentication response
  * @param expectedType **(Optional)** - The response type expected ('webauthn.get')
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param advancedFIDOConfig **(Optional)** - Options for satisfying more stringent FIDO RP feature requirements
  * @param advancedFIDOConfig.userVerification **(Optional)** - Enable alternative rules for evaluating the User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional unless this value is `"required"`
  */
 async function verifyAuthenticationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, authenticator, requireUserVerification = true, advancedFIDOConfig, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, credential, requireUserVerification = true, advancedFIDOConfig, } = options;
     const { id, rawId, type: credentialType, response: assertionResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -144,24 +144,24 @@ async function verifyAuthenticationResponse(options) {
     const clientDataHash = await (0, toHash_js_1.toHash)(index_js_1.isoBase64URL.toBuffer(assertionResponse.clientDataJSON));
     const signatureBase = index_js_1.isoUint8Array.concat([authDataBuffer, clientDataHash]);
     const signature = index_js_1.isoBase64URL.toBuffer(assertionResponse.signature);
-    if ((counter > 0 || authenticator.counter > 0) &&
-        counter <= authenticator.counter) {
+    if ((counter > 0 || credential.counter > 0) &&
+        counter <= credential.counter) {
         // Error out when the counter in the DB is greater than or equal to the counter in the
         // dataStruct. It's related to how the authenticator maintains the number of times its been
         // used for this client. If this happens, then someone's somehow increased the counter
         // on the device without going through this site
-        throw new Error(`Response counter value ${counter} was lower than expected ${authenticator.counter}`);
+        throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
     }
     const { credentialDeviceType, credentialBackedUp } = (0, parseBackupFlags_js_1.parseBackupFlags)(flags);
     const toReturn = {
         verified: await (0, verifySignature_js_1.verifySignature)({
             signature,
             data: signatureBase,
-            credentialPublicKey: authenticator.credentialPublicKey,
+            credentialPublicKey: credential.publicKey,
         }),
         authenticationInfo: {
             newCounter: counter,
-            credentialID: authenticator.credentialID,
+            credentialID: credential.id,
             userVerified: flags.uv,
             credentialDeviceType,
             credentialBackedUp,

package/script/deps.d.ts

@@ -1,9 +1,9 @@
-export type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationResponseJSON, AuthenticatorDevice, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, Crypto, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, UserVerificationRequirement, } from '@simplewebauthn/types';
+export type { AttestationConveyancePreference, AuthenticationExtensionsClientInputs, AuthenticationResponseJSON, AuthenticatorSelectionCriteria, AuthenticatorTransportFuture, Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, Crypto, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialParameters, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, UserVerificationRequirement, WebAuthnCredential, } from '@simplewebauthn/types';
 export * as tinyCbor from '@levischuck/tiny-cbor';
 export { default as base64 } from '@hexagon/base64';
 export { fetch as crossFetch } from 'cross-fetch';
-export { AsnParser, AsnSerializer } from '@peculiar/asn1-schema';
-export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
+export { AsnParser, AsnSerializer, OctetString } from '@peculiar/asn1-schema';
+export { AuthorityKeyIdentifier, BasicConstraints, Certificate, CertificateList, CRLDistributionPoints, ExtendedKeyUsage, Extensions, id_ce_authorityKeyIdentifier, id_ce_basicConstraints, id_ce_cRLDistributionPoints, id_ce_extKeyUsage, id_ce_subjectAltName, id_ce_subjectKeyIdentifier, Name, SubjectAlternativeName, SubjectKeyIdentifier, } from '@peculiar/asn1-x509';
 export { ECDSASigValue, ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1, } from '@peculiar/asn1-ecc';
 export { RSAPublicKey } from '@peculiar/asn1-rsa';
 export { id_ce_keyDescription, KeyDescription } from '@peculiar/asn1-android';

package/script/deps.js

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KeyDescription = exports.id_ce_keyDescription = exports.RSAPublicKey = exports.id_secp384r1 = exports.id_secp256r1 = exports.id_ecPublicKey = exports.ECParameters = exports.ECDSASigValue = exports.SubjectKeyIdentifier = exports.SubjectAlternativeName = exports.Name = exports.id_ce_subjectKeyIdentifier = exports.id_ce_subjectAltName = exports.id_ce_extKeyUsage = exports.id_ce_cRLDistributionPoints = exports.id_ce_basicConstraints = exports.id_ce_authorityKeyIdentifier = exports.ExtendedKeyUsage = exports.CRLDistributionPoints = exports.CertificateList = exports.Certificate = exports.BasicConstraints = exports.AuthorityKeyIdentifier = exports.AsnSerializer = exports.AsnParser = exports.crossFetch = exports.base64 = exports.tinyCbor = void 0;
+exports.KeyDescription = exports.id_ce_keyDescription = exports.RSAPublicKey = exports.id_secp384r1 = exports.id_secp256r1 = exports.id_ecPublicKey = exports.ECParameters = exports.ECDSASigValue = exports.SubjectKeyIdentifier = exports.SubjectAlternativeName = exports.Name = exports.id_ce_subjectKeyIdentifier = exports.id_ce_subjectAltName = exports.id_ce_extKeyUsage = exports.id_ce_cRLDistributionPoints = exports.id_ce_basicConstraints = exports.id_ce_authorityKeyIdentifier = exports.Extensions = exports.ExtendedKeyUsage = exports.CRLDistributionPoints = exports.CertificateList = exports.Certificate = exports.BasicConstraints = exports.AuthorityKeyIdentifier = exports.OctetString = exports.AsnSerializer = exports.AsnParser = exports.crossFetch = exports.base64 = exports.tinyCbor = void 0;
 // tiny_cbor (a.k.a. tiny-cbor in Node land)
 exports.tinyCbor = __importStar(require("@levischuck/tiny-cbor"));
 // b64 (a.k.a. @hexagon/base64 in Node land)
@@ -39,6 +39,7 @@ Object.defineProperty(exports, "crossFetch", { enumerable: true, get: function (
 var asn1_schema_1 = require("@peculiar/asn1-schema");
 Object.defineProperty(exports, "AsnParser", { enumerable: true, get: function () { return asn1_schema_1.AsnParser; } });
 Object.defineProperty(exports, "AsnSerializer", { enumerable: true, get: function () { return asn1_schema_1.AsnSerializer; } });
+Object.defineProperty(exports, "OctetString", { enumerable: true, get: function () { return asn1_schema_1.OctetString; } });
 var asn1_x509_1 = require("@peculiar/asn1-x509");
 Object.defineProperty(exports, "AuthorityKeyIdentifier", { enumerable: true, get: function () { return asn1_x509_1.AuthorityKeyIdentifier; } });
 Object.defineProperty(exports, "BasicConstraints", { enumerable: true, get: function () { return asn1_x509_1.BasicConstraints; } });
@@ -46,6 +47,7 @@ Object.defineProperty(exports, "Certificate", { enumerable: true, get: function
 Object.defineProperty(exports, "CertificateList", { enumerable: true, get: function () { return asn1_x509_1.CertificateList; } });
 Object.defineProperty(exports, "CRLDistributionPoints", { enumerable: true, get: function () { return asn1_x509_1.CRLDistributionPoints; } });
 Object.defineProperty(exports, "ExtendedKeyUsage", { enumerable: true, get: function () { return asn1_x509_1.ExtendedKeyUsage; } });
+Object.defineProperty(exports, "Extensions", { enumerable: true, get: function () { return asn1_x509_1.Extensions; } });
 Object.defineProperty(exports, "id_ce_authorityKeyIdentifier", { enumerable: true, get: function () { return asn1_x509_1.id_ce_authorityKeyIdentifier; } });
 Object.defineProperty(exports, "id_ce_basicConstraints", { enumerable: true, get: function () { return asn1_x509_1.id_ce_basicConstraints; } });
 Object.defineProperty(exports, "id_ce_cRLDistributionPoints", { enumerable: true, get: function () { return asn1_x509_1.id_ce_cRLDistributionPoints; } });

package/script/helpers/decodeAuthenticatorExtensions.d.ts

@@ -4,17 +4,7 @@
  * @param extensionData Authenticator Extension Data buffer
  */
 export declare function decodeAuthenticatorExtensions(extensionData: Uint8Array): AuthenticationExtensionsAuthenticatorOutputs | undefined;
-export type AuthenticationExtensionsAuthenticatorOutputs = {
-    devicePubKey?: DevicePublicKeyAuthenticatorOutput;
-    uvm?: UVMAuthenticatorOutput;
-};
-export type DevicePublicKeyAuthenticatorOutput = {
-    dpk?: Uint8Array;
-    sig?: string;
-    nonce?: Uint8Array;
-    scope?: Uint8Array;
-    aaguid?: Uint8Array;
-};
-export type UVMAuthenticatorOutput = {
-    uvm?: Uint8Array[];
-};
+/**
+ * Attempt to support authenticator extensions we might not know about in WebAuthn
+ */
+export type AuthenticationExtensionsAuthenticatorOutputs = unknown;

package/script/helpers/validateExtFIDOGenCEAAGUID.d.ts

@@ -0,0 +1,6 @@
+import { Extensions } from '../deps.js';
+/**
+ * Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
+ * the attestation statement AAGUID.
+ */
+export declare function validateExtFIDOGenCEAAGUID(certExtensions: Extensions | undefined, aaguid: Uint8Array): boolean;

package/script/helpers/validateExtFIDOGenCEAAGUID.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateExtFIDOGenCEAAGUID = void 0;
+const deps_js_1 = require("../deps.js");
+const index_js_1 = require("./iso/index.js");
+/**
+ * Attestation Certificate Extension OID: `id-fido-gen-ce-aaguid`
+ *
+ * Sourced from https://fidoalliance.org/specs/fido-v2.0-ps-20150904/fido-key-attestation-v2.0-ps-20150904.html#verifying-an-attestation-statement
+ */
+const id_fido_gen_ce_aaguid = '1.3.6.1.4.1.45724.1.1.4';
+/**
+ * Look for the id-fido-gen-ce-aaguid certificate extension. If it's present then check it against
+ * the attestation statement AAGUID.
+ */
+function validateExtFIDOGenCEAAGUID(certExtensions, aaguid) {
+    // The certificate had no extensions so there's nothing to validate
+    if (!certExtensions) {
+        return true;
+    }
+    const extFIDOGenCEAAGUID = certExtensions.find((ext) => ext.extnID === id_fido_gen_ce_aaguid);
+    // The extension isn't present so there's nothing to validate
+    if (!extFIDOGenCEAAGUID) {
+        return true;
+    }
+    // Parse the extension value
+    const parsedExtFIDOGenCEAAGUID = deps_js_1.AsnParser.parse(extFIDOGenCEAAGUID.extnValue, deps_js_1.OctetString);
+    const extValue = new Uint8Array(parsedExtFIDOGenCEAAGUID.buffer);
+    // Compare the two values
+    const aaguidAndExtAreEqual = index_js_1.isoUint8Array.areEqual(aaguid, extValue);
+    if (!aaguidAndExtAreEqual) {
+        const _debugExtHex = index_js_1.isoUint8Array.toHex(extValue);
+        const _debugAAGUIDHex = index_js_1.isoUint8Array.toHex(aaguid);
+        throw new Error(`Certificate extension id-fido-gen-ce-aaguid (${id_fido_gen_ce_aaguid}) value of "${_debugExtHex}" was present but not equal to attestation statement AAGUID value of "${_debugAAGUIDHex}"`);
+    }
+    return true;
+}
+exports.validateExtFIDOGenCEAAGUID = validateExtFIDOGenCEAAGUID;

package/script/registration/verifications/tpm/constants.js

@@ -112,6 +112,10 @@ exports.TPM_MANUFACTURERS = {
         name: 'IBM',
         id: 'IBM',
     },
+    'id:49424D00': {
+        name: 'IBM',
+        id: 'IBM',
+    },
     'id:49465800': {
         name: 'Infineon',
         id: 'IFX',

package/script/registration/verifications/tpm/verifyAttestationTPM.js

@@ -10,6 +10,7 @@ const validateCertificatePath_js_1 = require("../../../helpers/validateCertifica
 const getCertificateInfo_js_1 = require("../../../helpers/getCertificateInfo.js");
 const verifySignature_js_1 = require("../../../helpers/verifySignature.js");
 const index_js_1 = require("../../../helpers/iso/index.js");
+const validateExtFIDOGenCEAAGUID_js_1 = require("../../../helpers/validateExtFIDOGenCEAAGUID.js");
 const metadataService_js_1 = require("../../../services/metadataService.js");
 const verifyAttestationWithMetadata_js_1 = require("../../../metadata/verifyAttestationWithMetadata.js");
 const constants_js_1 = require("./constants.js");
@@ -209,8 +210,14 @@ async function verifyAttestationTPM(options) {
     if (extKeyUsage[0] !== '2.23.133.8.3') {
         throw new Error(`Unexpected extKeyUsage "${extKeyUsage[0]}", expected "2.23.133.8.3" (TPM)`);
     }
-    // TODO: If certificate contains id-fido-gen-ce-aaguid(1.3.6.1.4.1.45724.1.1.4) extension, check
-    // that it’s value is set to the same AAGUID as in authData.
+    // Validate attestation statement AAGUID against leaf cert AAGUID
+    try {
+        await (0, validateExtFIDOGenCEAAGUID_js_1.validateExtFIDOGenCEAAGUID)(parsedCert.tbsCertificate.extensions, aaguid);
+    }
+    catch (err) {
+        const _err = err;
+        throw new Error(`${_err.message} (TPM)`);
+    }
     // Run some metadata checks if a statement exists for this authenticator
     const statement = await metadataService_js_1.MetadataService.getStatement(aaguid);
     if (statement) {

package/script/registration/verifications/verifyAttestationPacked.js

@@ -7,6 +7,7 @@ const validateCertificatePath_js_1 = require("../../helpers/validateCertificateP
 const getCertificateInfo_js_1 = require("../../helpers/getCertificateInfo.js");
 const verifySignature_js_1 = require("../../helpers/verifySignature.js");
 const index_js_1 = require("../../helpers/iso/index.js");
+const validateExtFIDOGenCEAAGUID_js_1 = require("../../helpers/validateExtFIDOGenCEAAGUID.js");
 const metadataService_js_1 = require("../../services/metadataService.js");
 const verifyAttestationWithMetadata_js_1 = require("../../metadata/verifyAttestationWithMetadata.js");
 /**
@@ -29,7 +30,7 @@ async function verifyAttestationPacked(options) {
     const signatureBase = index_js_1.isoUint8Array.concat([authData, clientDataHash]);
     let verified = false;
     if (x5c) {
-        const { subject, basicConstraintsCA, version, notBefore, notAfter } = (0, getCertificateInfo_js_1.getCertificateInfo)(x5c[0]);
+        const { subject, basicConstraintsCA, version, notBefore, notAfter, parsedCertificate, } = (0, getCertificateInfo_js_1.getCertificateInfo)(x5c[0]);
         const { OU, CN, O, C } = subject;
         if (OU !== 'Authenticator Attestation') {
             throw new Error('Certificate OU was not "Authenticator Attestation" (Packed|Full)');
@@ -57,8 +58,14 @@ async function verifyAttestationPacked(options) {
         if (notAfter < now) {
             throw new Error(`Certificate not good after "${notAfter.toString()}" (Packed|Full)`);
         }
-        // TODO: If certificate contains id-fido-gen-ce-aaguid(1.3.6.1.4.1.45724.1.1.4) extension, check
-        // that it’s value is set to the same AAGUID as in authData.
+        // Validate attestation statement AAGUID against leaf cert AAGUID
+        try {
+            await (0, validateExtFIDOGenCEAAGUID_js_1.validateExtFIDOGenCEAAGUID)(parsedCertificate.tbsCertificate.extensions, aaguid);
+        }
+        catch (err) {
+            const _err = err;
+            throw new Error(`${_err.message} (Packed|Full)`);
+        }
         // If available, validate attestation alg and x5c with info in the metadata statement
         const statement = await metadataService_js_1.MetadataService.getStatement(aaguid);
         if (statement) {

package/script/registration/verifyRegistrationResponse.d.ts

@@ -1,4 +1,4 @@
-import type { Base64URLString, COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON } from '../deps.js';
+import type { COSEAlgorithmIdentifier, CredentialDeviceType, RegistrationResponseJSON, WebAuthnCredential } from '../deps.js';
 import { AttestationFormat, AttestationStatement } from '../helpers/decodeAttestationObject.js';
 import { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions.js';
 export type VerifyRegistrationResponseOpts = {
@@ -7,6 +7,7 @@ export type VerifyRegistrationResponseOpts = {
     expectedOrigin: string | string[];
     expectedRPID?: string | string[];
     expectedType?: string | string[];
+    requireUserPresence?: boolean;
     requireUserVerification?: boolean;
     supportedAlgorithmIDs?: COSEAlgorithmIdentifier[];
 };
@@ -20,6 +21,7 @@ export type VerifyRegistrationResponseOpts = {
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
+ * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
  */
@@ -54,10 +56,8 @@ export type VerifiedRegistrationResponse = {
     verified: boolean;
     registrationInfo?: {
         fmt: AttestationFormat;
-        counter: number;
         aaguid: string;
-        credentialID: Base64URLString;
-        credentialPublicKey: Uint8Array;
+        credential: WebAuthnCredential;
         credentialType: 'public-key';
         attestationObject: Uint8Array;
         userVerified: boolean;

package/script/registration/verifyRegistrationResponse.js

@@ -29,11 +29,12 @@ const verifyAttestationApple_js_1 = require("./verifications/verifyAttestationAp
  * @param expectedOrigin - Website URL (or array of URLs) that the registration should have occurred on
  * @param expectedRPID - RP ID (or array of IDs) that was specified in the registration options
  * @param expectedType **(Optional)** - The response type expected ('webauthn.create')
+ * @param requireUserPresence **(Optional)** - Enforce user presence by the authenticator (or skip it during auto registration) Defaults to `true`
  * @param requireUserVerification **(Optional)** - Enforce user verification by the authenticator (via PIN, fingerprint, etc...) Defaults to `true`
  * @param supportedAlgorithmIDs **(Optional)** - Array of numeric COSE algorithm identifiers supported for attestation by this RP. See https://www.iana.org/assignments/cose/cose.xhtml#algorithms. Defaults to all supported algorithm IDs
  */
 async function verifyRegistrationResponse(options) {
-    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserVerification = true, supportedAlgorithmIDs = generateRegistrationOptions_js_1.supportedCOSEAlgorithmIdentifiers, } = options;
+    const { response, expectedChallenge, expectedOrigin, expectedRPID, expectedType, requireUserPresence = true, requireUserVerification = true, supportedAlgorithmIDs = generateRegistrationOptions_js_1.supportedCOSEAlgorithmIdentifiers, } = options;
     const { id, rawId, type: credentialType, response: attestationResponse } = response;
     // Ensure credential specified an ID
     if (!id) {
@@ -112,12 +113,12 @@ async function verifyRegistrationResponse(options) {
         matchedRPID = await (0, matchExpectedRPID_js_1.matchExpectedRPID)(rpIdHash, expectedRPIDs);
     }
     // Make sure someone was physically present
-    if (!flags.up) {
-        throw new Error('User not present during registration');
+    if (requireUserPresence && !flags.up) {
+        throw new Error('User presence was required, but user was not present');
     }
     // Enforce user verification if specified
     if (requireUserVerification && !flags.uv) {
-        throw new Error('User verification required, but user could not be verified');
+        throw new Error('User verification was required, but user could not be verified');
     }
     if (!credentialID) {
         throw new Error('No credential ID was provided by authenticator');
@@ -192,11 +193,14 @@ async function verifyRegistrationResponse(options) {
         const { credentialDeviceType, credentialBackedUp } = (0, parseBackupFlags_js_1.parseBackupFlags)(flags);
         toReturn.registrationInfo = {
             fmt,
-            counter,
             aaguid: (0, convertAAGUIDToString_js_1.convertAAGUIDToString)(aaguid),
-            credentialID: index_js_1.isoBase64URL.fromBuffer(credentialID),
-            credentialPublicKey,
             credentialType,
+            credential: {
+                id: index_js_1.isoBase64URL.fromBuffer(credentialID),
+                publicKey: credentialPublicKey,
+                counter,
+                transports: response.response.transports,
+            },
             attestationObject,
             userVerified: flags.uv,
             credentialDeviceType,