@simplewebauthn/server 5.4.4 → 5.4.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/// <reference types="node" />
|
|
2
|
-
import { AuthenticationCredentialJSON, AuthenticatorDevice, CredentialDeviceType } from '@simplewebauthn/typescript-types';
|
|
2
|
+
import { AuthenticationCredentialJSON, AuthenticatorDevice, CredentialDeviceType, UserVerificationRequirement } from '@simplewebauthn/typescript-types';
|
|
3
3
|
import { AuthenticationExtensionsAuthenticatorOutputs } from '../helpers/decodeAuthenticatorExtensions';
|
|
4
4
|
export declare type VerifyAuthenticationResponseOpts = {
|
|
5
5
|
credential: AuthenticationCredentialJSON;
|
|
@@ -8,6 +8,9 @@ export declare type VerifyAuthenticationResponseOpts = {
|
|
|
8
8
|
expectedRPID: string | string[];
|
|
9
9
|
authenticator: AuthenticatorDevice;
|
|
10
10
|
requireUserVerification?: boolean;
|
|
11
|
+
advancedFIDOConfig?: {
|
|
12
|
+
userVerification?: UserVerificationRequirement;
|
|
13
|
+
};
|
|
11
14
|
};
|
|
12
15
|
/**
|
|
13
16
|
* Verify that the user has legitimately completed the login process
|
|
@@ -22,6 +25,11 @@ export declare type VerifyAuthenticationResponseOpts = {
|
|
|
22
25
|
* @param authenticator An internal {@link AuthenticatorDevice} matching the credential's ID
|
|
23
26
|
* @param requireUserVerification (Optional) Enforce user verification by the authenticator
|
|
24
27
|
* (via PIN, fingerprint, etc...)
|
|
28
|
+
* @param advancedFIDOConfig (Optional) Options for satisfying more stringent FIDO RP feature
|
|
29
|
+
* requirements
|
|
30
|
+
* @param advancedFIDOConfig.userVerification (Optional) Enable alternative rules for evaluating the
|
|
31
|
+
* User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional
|
|
32
|
+
* unless this value is `"required"`
|
|
25
33
|
*/
|
|
26
34
|
export declare function verifyAuthenticationResponse(options: VerifyAuthenticationResponseOpts): VerifiedAuthenticationResponse;
|
|
27
35
|
/**
|
|
@@ -25,9 +25,14 @@ const parseBackupFlags_1 = require("../helpers/parseBackupFlags");
|
|
|
25
25
|
* @param authenticator An internal {@link AuthenticatorDevice} matching the credential's ID
|
|
26
26
|
* @param requireUserVerification (Optional) Enforce user verification by the authenticator
|
|
27
27
|
* (via PIN, fingerprint, etc...)
|
|
28
|
+
* @param advancedFIDOConfig (Optional) Options for satisfying more stringent FIDO RP feature
|
|
29
|
+
* requirements
|
|
30
|
+
* @param advancedFIDOConfig.userVerification (Optional) Enable alternative rules for evaluating the
|
|
31
|
+
* User Presence and User Verified flags in authenticator data: UV (and UP) flags are optional
|
|
32
|
+
* unless this value is `"required"`
|
|
28
33
|
*/
|
|
29
34
|
function verifyAuthenticationResponse(options) {
|
|
30
|
-
const { credential, expectedChallenge, expectedOrigin, expectedRPID, authenticator, requireUserVerification, } = options;
|
|
35
|
+
const { credential, expectedChallenge, expectedOrigin, expectedRPID, authenticator, requireUserVerification, advancedFIDOConfig, } = options;
|
|
31
36
|
const { id, rawId, type: credentialType, response } = credential;
|
|
32
37
|
// Ensure credential specified an ID
|
|
33
38
|
if (!id) {
|
|
@@ -111,13 +116,33 @@ function verifyAuthenticationResponse(options) {
|
|
|
111
116
|
throw new Error(`Unexpected RP ID hash`);
|
|
112
117
|
}
|
|
113
118
|
}
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
119
|
+
if (advancedFIDOConfig !== undefined) {
|
|
120
|
+
const { userVerification: fidoUserVerification, } = advancedFIDOConfig;
|
|
121
|
+
/**
|
|
122
|
+
* Use FIDO Conformance-defined rules for verifying UP and UV flags
|
|
123
|
+
*/
|
|
124
|
+
if (fidoUserVerification === 'required') {
|
|
125
|
+
// Require `flags.uv` be true (implies `flags.up` is true)
|
|
126
|
+
if (!flags.uv) {
|
|
127
|
+
throw new Error('User verification required, but user could not be verified');
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
else if (fidoUserVerification === 'preferred' || fidoUserVerification === 'discouraged') {
|
|
131
|
+
// Ignore `flags.uv`
|
|
132
|
+
}
|
|
117
133
|
}
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
134
|
+
else {
|
|
135
|
+
/**
|
|
136
|
+
* Use WebAuthn spec-defined rules for verifying UP and UV flags
|
|
137
|
+
*/
|
|
138
|
+
// WebAuthn only requires the user presence flag be true
|
|
139
|
+
if (!flags.up) {
|
|
140
|
+
throw new Error('User not present during authentication');
|
|
141
|
+
}
|
|
142
|
+
// Enforce user verification if required
|
|
143
|
+
if (requireUserVerification && !flags.uv) {
|
|
144
|
+
throw new Error('User verification required, but user could not be verified');
|
|
145
|
+
}
|
|
121
146
|
}
|
|
122
147
|
const clientDataHash = (0, toHash_1.toHash)(base64url_1.default.toBuffer(response.clientDataJSON));
|
|
123
148
|
const signatureBase = Buffer.concat([authDataBuffer, clientDataHash]);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyAuthenticationResponse.js","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":";;;;;;AAAA,0DAAkC;
|
|
1
|
+
{"version":3,"file":"verifyAuthenticationResponse.js","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":";;;;;;AAAA,0DAAkC;AAQlC,0EAAuE;AACvE,8CAA2C;AAC3C,4EAAyE;AACzE,gEAA6D;AAC7D,8EAA2E;AAC3E,oEAAiE;AACjE,kEAA+D;AAe/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,4BAA4B,CAC1C,OAAyC;IAEzC,MAAM,EACJ,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,kBAAkB,GACnB,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC;IAEjE,oCAAoC;IACpC,IAAI,CAAC,EAAE,EAAE;QACP,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;KAC1C;IAED,iCAAiC;IACjC,IAAI,EAAE,KAAK,KAAK,EAAE;QAChB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IAED,0CAA0C;IAC1C,IAAI,cAAc,KAAK,YAAY,EAAE;QACnC,MAAM,IAAI,KAAK,CAAC,8BAA8B,cAAc,yBAAyB,CAAC,CAAC;KACxF;IAED,IAAI,CAAC,QAAQ,EAAE;QACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;KAChD;IAED,IAAI,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,cAAc,CAAA,KAAK,QAAQ,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;KACxE;IAED,MAAM,cAAc,GAAG,IAAA,2CAAoB,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAErE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC;IAEjE,6CAA6C;IAC7C,IAAI,IAAI,KAAK,cAAc,EAAE;QAC3B,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;KACrE;IAED,sDAAsD;IACtD,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;QAC3C,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE;YACjC,MAAM,IAAI,KAAK,CACb,iFAAiF,SAAS,GAAG,CAC9F,CAAC;SACH;KACF;SAAM,IAAI,SAAS,KAAK,iBAAiB,EAAE;QAC1C,MAAM,IAAI,KAAK,CACb,iDAAiD,SAAS,gBAAgB,iBAAiB,GAAG,CAC/F,CAAC;KACH;IAED,oCAAoC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE;QACjC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;YACpC,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,uBAAuB,oBAAoB,EAAE,CAClG,CAAC;SACH;KACF;SAAM;QACL,IAAI,MAAM,KAAK,cAAc,EAAE;YAC7B,MAAM,IAAI,KAAK,CACb,8CAA8C,MAAM,gBAAgB,cAAc,GAAG,CACtF,CAAC;SACH;KACF;IAED,IAAI,CAAC,IAAA,qCAAiB,EAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAClD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;KACrF;IAED,IAAI,CAAC,IAAA,qCAAiB,EAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAC1C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;KAC7E;IAED,IAAI,QAAQ,CAAC,UAAU,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE;QAClE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;KACpE;IAED,IAAI,YAAY,EAAE;QAChB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QAED,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC7E,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;SAC1E;KACF;IAED,MAAM,cAAc,GAAG,mBAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,cAAc,GAAG,IAAA,+CAAsB,EAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,CAAC;IAEpE,yCAAyC;IACzC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE;QACpC,MAAM,gBAAgB,GAAG,IAAA,eAAM,EAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE;YACtC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;SAC1C;KACF;SAAM;QACL,kEAAkE;QAClE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC9C,MAAM,gBAAgB,GAAG,IAAA,eAAM,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,OAAO,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,EAAE;YACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;SAC1C;KACF;IAED,IAAI,kBAAkB,KAAK,SAAS,EAAE;QACpC,MAAM,EACJ,gBAAgB,EAAE,oBAAoB,GACvC,GAAG,kBAAkB,CAAC;QAEvB;;WAEG;QACH,IAAI,oBAAoB,KAAK,UAAU,EAAE;YACvC,0DAA0D;YAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;gBACb,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;aAC/E;SACF;aAAM,IAAI,oBAAoB,KAAK,WAAW,IAAI,oBAAoB,KAAK,aAAa,EAAE;YACzF,oBAAoB;SACrB;KACF;SAAM;QACL;;WAEG;QACH,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;YACb,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;SAC3D;QAED,wCAAwC;QACxC,IAAI,uBAAuB,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;SAC/E;KACF;IAED,MAAM,cAAc,GAAG,IAAA,eAAM,EAAC,mBAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,IAAA,6CAAqB,EAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,mBAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEzD,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE;QAClF,sFAAsF;QACtF,2FAA2F;QAC3F,sFAAsF;QACtF,gDAAgD;QAChD,MAAM,IAAI,KAAK,CACb,0BAA0B,OAAO,4BAA4B,aAAa,CAAC,OAAO,EAAE,CACrF,CAAC;KACH;IAED,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,IAAA,mCAAgB,EAAC,KAAK,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG;QACf,QAAQ,EAAE,IAAA,iCAAe,EAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC;QAC9D,kBAAkB,EAAE;YAClB,UAAU,EAAE,OAAO;YACnB,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,oBAAoB;YACpB,kBAAkB;YAClB,6BAA6B,EAAE,cAAc;SAC9C;KACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AApLD,oEAoLC"}
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
*/
|
|
7
7
|
export declare function decodeAuthenticatorExtensions(extensionData: Buffer): AuthenticationExtensionsAuthenticatorOutputs | undefined;
|
|
8
8
|
export declare type AuthenticationExtensionsAuthenticatorOutputs = {
|
|
9
|
-
|
|
9
|
+
devicePubKey?: DevicePublicKeyAuthenticatorOutput;
|
|
10
10
|
uvm?: UVMAuthenticatorOutput;
|
|
11
11
|
};
|
|
12
12
|
export declare type DevicePublicKeyAuthenticatorOutput = {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@simplewebauthn/server",
|
|
3
|
-
"version": "5.4.
|
|
3
|
+
"version": "5.4.5",
|
|
4
4
|
"description": "SimpleWebAuthn for Servers",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -59,7 +59,7 @@
|
|
|
59
59
|
"node-fetch": "^2.6.0",
|
|
60
60
|
"node-rsa": "^1.1.1"
|
|
61
61
|
},
|
|
62
|
-
"gitHead": "
|
|
62
|
+
"gitHead": "d5fbeb340fb2610c86f102f184aa75a0d27cc243",
|
|
63
63
|
"devDependencies": {
|
|
64
64
|
"@types/cbor": "^5.0.1",
|
|
65
65
|
"@types/debug": "^4.1.7",
|