@simplewebauthn/server 7.0.1 → 7.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/helpers/convertPEMToBytes.js +1 -1
- package/dist/helpers/convertPEMToBytes.js.map +1 -1
- package/dist/metadata/verifyJWT.d.ts +2 -3
- package/dist/metadata/verifyJWT.js +14 -5
- package/dist/metadata/verifyJWT.js.map +1 -1
- package/dist/registration/generateRegistrationOptions.js +5 -3
- package/dist/registration/generateRegistrationOptions.js.map +1 -1
- package/package.json +6 -8
|
@@ -9,7 +9,7 @@ function convertPEMToBytes(pem) {
|
|
|
9
9
|
const certBase64 = pem
|
|
10
10
|
.replace('-----BEGIN CERTIFICATE-----', '')
|
|
11
11
|
.replace('-----END CERTIFICATE-----', '')
|
|
12
|
-
.replace(
|
|
12
|
+
.replace(/[\n ]/g, '');
|
|
13
13
|
return iso_1.isoBase64URL.toBuffer(certBase64, 'base64');
|
|
14
14
|
}
|
|
15
15
|
exports.convertPEMToBytes = convertPEMToBytes;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"convertPEMToBytes.js","sourceRoot":"","sources":["../../src/helpers/convertPEMToBytes.ts"],"names":[],"mappings":";;;AAAA,+BAAqC;AAErC;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,UAAU,GAAG,GAAG;SACnB,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;SAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;SACxC,OAAO,CAAC,
|
|
1
|
+
{"version":3,"file":"convertPEMToBytes.js","sourceRoot":"","sources":["../../src/helpers/convertPEMToBytes.ts"],"names":[],"mappings":";;;AAAA,+BAAqC;AAErC;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,UAAU,GAAG,GAAG;SACnB,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;SAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;SACxC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzB,OAAO,kBAAY,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAPD,8CAOC"}
|
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Lightweight verification for FIDO MDS JWTs.
|
|
2
|
+
* Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
* needs to support more JWS algorithms, here's the list of them:
|
|
4
|
+
* If this ever needs to support more JWS algorithms, here's the list of them:
|
|
6
5
|
*
|
|
7
6
|
* https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1
|
|
8
7
|
*
|
|
@@ -5,11 +5,11 @@ const convertX509PublicKeyToCOSE_1 = require("../helpers/convertX509PublicKeyToC
|
|
|
5
5
|
const iso_1 = require("../helpers/iso");
|
|
6
6
|
const cose_1 = require("../helpers/cose");
|
|
7
7
|
const verifyEC2_1 = require("../helpers/iso/isoCrypto/verifyEC2");
|
|
8
|
+
const verifyRSA_1 = require("../helpers/iso/isoCrypto/verifyRSA");
|
|
8
9
|
/**
|
|
9
|
-
* Lightweight verification for FIDO MDS JWTs.
|
|
10
|
+
* Lightweight verification for FIDO MDS JWTs. Supports use of EC2 and RSA.
|
|
10
11
|
*
|
|
11
|
-
*
|
|
12
|
-
* needs to support more JWS algorithms, here's the list of them:
|
|
12
|
+
* If this ever needs to support more JWS algorithms, here's the list of them:
|
|
13
13
|
*
|
|
14
14
|
* https://www.rfc-editor.org/rfc/rfc7518.html#section-3.1
|
|
15
15
|
*
|
|
@@ -18,14 +18,23 @@ const verifyEC2_1 = require("../helpers/iso/isoCrypto/verifyEC2");
|
|
|
18
18
|
async function verifyJWT(jwt, leafCert) {
|
|
19
19
|
const [header, payload, signature] = jwt.split('.');
|
|
20
20
|
const certCOSE = (0, convertX509PublicKeyToCOSE_1.convertX509PublicKeyToCOSE)(leafCert);
|
|
21
|
+
const data = iso_1.isoUint8Array.fromUTF8String(`${header}.${payload}`);
|
|
22
|
+
const signatureBytes = iso_1.isoBase64URL.toBuffer(signature);
|
|
21
23
|
if ((0, cose_1.isCOSEPublicKeyEC2)(certCOSE)) {
|
|
22
24
|
return (0, verifyEC2_1.verifyEC2)({
|
|
23
|
-
data
|
|
24
|
-
signature:
|
|
25
|
+
data,
|
|
26
|
+
signature: signatureBytes,
|
|
25
27
|
cosePublicKey: certCOSE,
|
|
26
28
|
shaHashOverride: cose_1.COSEALG.ES256,
|
|
27
29
|
});
|
|
28
30
|
}
|
|
31
|
+
else if ((0, cose_1.isCOSEPublicKeyRSA)(certCOSE)) {
|
|
32
|
+
return (0, verifyRSA_1.verifyRSA)({
|
|
33
|
+
data,
|
|
34
|
+
signature: signatureBytes,
|
|
35
|
+
cosePublicKey: certCOSE,
|
|
36
|
+
});
|
|
37
|
+
}
|
|
29
38
|
const kty = certCOSE.get(cose_1.COSEKEYS.kty);
|
|
30
39
|
throw new Error(`JWT verification with public key of kty ${kty} is not supported by this method`);
|
|
31
40
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verifyJWT.js","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":";;;AAAA,sFAAmF;AACnF,wCAA6D;AAC7D,
|
|
1
|
+
{"version":3,"file":"verifyJWT.js","sourceRoot":"","sources":["../../src/metadata/verifyJWT.ts"],"names":[],"mappings":";;;AAAA,sFAAmF;AACnF,wCAA6D;AAC7D,0CAA4F;AAC5F,kEAA+D;AAC/D,kEAA+D;AAE/D;;;;;;;;GAQG;AACI,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,QAAoB;IAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAA,uDAA0B,EAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,mBAAa,CAAC,cAAc,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,kBAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAExD,IAAI,IAAA,yBAAkB,EAAC,QAAQ,CAAC,EAAE;QAChC,OAAO,IAAA,qBAAS,EAAC;YACf,IAAI;YACJ,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,cAAO,CAAC,KAAK;SAC/B,CAAC,CAAC;KACJ;SAAM,IAAI,IAAA,yBAAkB,EAAC,QAAQ,CAAC,EAAE;QACvC,OAAO,IAAA,qBAAS,EAAC;YACf,IAAI;YACJ,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAA;KACH;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAQ,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,KAAK,CACb,2CAA2C,GAAG,kCAAkC,CACjF,CAAC;AACJ,CAAC;AA1BD,8BA0BC"}
|
|
@@ -42,10 +42,12 @@ const defaultAuthenticatorSelection = {
|
|
|
42
42
|
userVerification: 'preferred',
|
|
43
43
|
};
|
|
44
44
|
/**
|
|
45
|
-
*
|
|
46
|
-
* See
|
|
45
|
+
* Use the most commonly-supported algorithms
|
|
46
|
+
* See the following:
|
|
47
|
+
* - https://www.iana.org/assignments/cose/cose.xhtml#algorithms
|
|
48
|
+
* - https://w3c.github.io/webauthn/#dom-publickeycredentialcreationoptions-pubkeycredparams
|
|
47
49
|
*/
|
|
48
|
-
const defaultSupportedAlgorithmIDs =
|
|
50
|
+
const defaultSupportedAlgorithmIDs = [-8, -7, -257];
|
|
49
51
|
/**
|
|
50
52
|
* Prepare a value to pass into navigator.credentials.create(...) for authenticator "registration"
|
|
51
53
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"generateRegistrationOptions.js","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":";;;AAUA,oEAAiE;AACjE,wCAA6D;AAiB7D;;;;GAIG;AACU,QAAA,iCAAiC,GAA8B;IAC1E,+EAA+E;IAC/E,CAAC,CAAC;IACF,mBAAmB;IACnB,CAAC,CAAC;IACF,mBAAmB;IACnB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,mEAAmE;IACnE,CAAC,KAAK;CACP,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAmC;IACpE,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,WAAW;CAC9B,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"generateRegistrationOptions.js","sourceRoot":"","sources":["../../src/registration/generateRegistrationOptions.ts"],"names":[],"mappings":";;;AAUA,oEAAiE;AACjE,wCAA6D;AAiB7D;;;;GAIG;AACU,QAAA,iCAAiC,GAA8B;IAC1E,+EAA+E;IAC/E,CAAC,CAAC;IACF,mBAAmB;IACnB,CAAC,CAAC;IACF,mBAAmB;IACnB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,wBAAwB;IACxB,CAAC,EAAE;IACH,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,+BAA+B;IAC/B,CAAC,GAAG;IACJ,mEAAmE;IACnE,CAAC,KAAK;CACP,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAmC;IACpE,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,WAAW;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,4BAA4B,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,2BAA2B,CACzC,OAAwC;IAExC,MAAM,EACJ,MAAM,EACN,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,GAAG,IAAA,qCAAiB,GAAE,EAC/B,eAAe,GAAG,QAAQ,EAC1B,OAAO,GAAG,KAAK,EACf,eAAe,GAAG,MAAM,EACxB,kBAAkB,GAAG,EAAE,EACvB,sBAAsB,GAAG,6BAA6B,EACtD,UAAU,EACV,qBAAqB,GAAG,4BAA4B,GACrD,GAAG,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,gBAAgB,GAAoC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzF,GAAG,EAAE,EAAE;QACP,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC,CAAC;IAEJ;;;OAGG;IACH,IAAI,sBAAsB,CAAC,WAAW,KAAK,SAAS,EAAE;QACpD;;;;;WAKG;QACH,IAAI,sBAAsB,CAAC,kBAAkB,EAAE;YAC7C,sBAAsB,CAAC,WAAW,GAAG,UAAU,CAAC;SACjD;aAAM;YACL;;;eAGG;YACH,sDAAsD;SACvD;KACF;SAAM;QACL;;;;;;;WAOG;QACH,sBAAsB,CAAC,kBAAkB,GAAG,sBAAsB,CAAC,WAAW,KAAK,UAAU,CAAC;KAC/F;IAED;;OAEG;IACH,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;QAClC,UAAU,GAAG,mBAAa,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;KACxD;IAED,OAAO;QACL,SAAS,EAAE,kBAAY,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,EAAE,EAAE;YACF,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,IAAI;SACT;QACD,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,eAAe;SAC7B;QACD,gBAAgB;QAChB,OAAO;QACP,WAAW,EAAE,eAAe;QAC5B,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,GAAG,IAAI;YACP,EAAE,EAAE,kBAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAgB,CAAC;SACnD,CAAC,CAAC;QACH,sBAAsB;QACtB,UAAU,EAAE;YACV,GAAG,UAAU;YACb,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;AACJ,CAAC;AA1FD,kEA0FC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@simplewebauthn/server",
|
|
3
|
-
"version": "7.0
|
|
3
|
+
"version": "7.3.0",
|
|
4
4
|
"description": "SimpleWebAuthn for Servers",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -54,15 +54,13 @@
|
|
|
54
54
|
"@peculiar/asn1-rsa": "^2.3.4",
|
|
55
55
|
"@peculiar/asn1-schema": "^2.3.3",
|
|
56
56
|
"@peculiar/asn1-x509": "^2.3.4",
|
|
57
|
-
"@simplewebauthn/iso-webcrypto": "^7.0
|
|
57
|
+
"@simplewebauthn/iso-webcrypto": "^7.2.0",
|
|
58
|
+
"@simplewebauthn/typescript-types": "*",
|
|
59
|
+
"@types/debug": "^4.1.7",
|
|
60
|
+
"@types/node": "^18.11.9",
|
|
58
61
|
"cbor-x": "^1.4.1",
|
|
59
62
|
"cross-fetch": "^3.1.5",
|
|
60
63
|
"debug": "^4.3.2"
|
|
61
64
|
},
|
|
62
|
-
"gitHead": "
|
|
63
|
-
"devDependencies": {
|
|
64
|
-
"@simplewebauthn/typescript-types": "*",
|
|
65
|
-
"@types/debug": "^4.1.7",
|
|
66
|
-
"@types/node": "^18.11.9"
|
|
67
|
-
}
|
|
65
|
+
"gitHead": "0ab19d8f8319ff6a36dbb53d14750bd345947eb8"
|
|
68
66
|
}
|