@stamhoofd/backend 2.138.0 → 2.138.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.138.0",
+    "version": "2.138.2",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -65,20 +65,20 @@
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.138.0",
-        "@stamhoofd/backend-i18n": "2.138.0",
-        "@stamhoofd/backend-middleware": "2.138.0",
-        "@stamhoofd/crons": "2.138.0",
-        "@stamhoofd/email": "2.138.0",
-        "@stamhoofd/excel-writer": "2.138.0",
-        "@stamhoofd/logging": "2.138.0",
-        "@stamhoofd/models": "2.138.0",
-        "@stamhoofd/object-differ": "2.138.0",
-        "@stamhoofd/queues": "2.138.0",
-        "@stamhoofd/sql": "2.138.0",
-        "@stamhoofd/structures": "2.138.0",
-        "@stamhoofd/types": "2.138.0",
-        "@stamhoofd/utility": "2.138.0",
+        "@stamhoofd/backend-env": "2.138.2",
+        "@stamhoofd/backend-i18n": "2.138.2",
+        "@stamhoofd/backend-middleware": "2.138.2",
+        "@stamhoofd/crons": "2.138.2",
+        "@stamhoofd/email": "2.138.2",
+        "@stamhoofd/excel-writer": "2.138.2",
+        "@stamhoofd/logging": "2.138.2",
+        "@stamhoofd/models": "2.138.2",
+        "@stamhoofd/object-differ": "2.138.2",
+        "@stamhoofd/queues": "2.138.2",
+        "@stamhoofd/sql": "2.138.2",
+        "@stamhoofd/structures": "2.138.2",
+        "@stamhoofd/types": "2.138.2",
+        "@stamhoofd/utility": "2.138.2",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.138.0",
+        "@stamhoofd/test-utils": "2.138.2",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "781877acb024516e384b4119af7e86f847a9d237"
+    "gitHead": "32d393fa2d3dacbd74aff03e62cc9244d2d7535f"
 }

package/src/helpers/WebauthnHelper.test.ts

@@ -0,0 +1,144 @@
+import { isoCBOR } from '@simplewebauthn/server/helpers';
+import { WebauthnCredential } from '@stamhoofd/models';
+import { WebauthnAssertionResponseData, WebauthnAuthenticationCredential } from '@stamhoofd/structures';
+import { TestUtils } from '@stamhoofd/test-utils';
+import crypto from 'crypto';
+
+import { WebauthnHelper } from './WebauthnHelper.js';
+
+// The fingerprint of one of the Android release certificates, in the notation of
+// assetlinks.json, and the origin Android derives from it.
+const FINGERPRINT = 'A0:7B:07:40:BD:36:D6:07:29:C5:E4:5C:06:68:C6:CE:4B:B0:F6:F8:CD:B3:51:FC:1E:CF:06:78:AF:7C:2C:75';
+const FINGERPRINT_ORIGIN = 'android:apk-key-hash:oHsHQL021gcpxeRcBmjGzkuw9vjNs1H8Hs8GeK98LHU';
+
+/**
+ * A passkey as an authenticator holds it: an ES256 key pair, plus the COSE encoding of the
+ * public key that we store on the credential.
+ */
+function createKeyPair() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const jwk = publicKey.export({ format: 'jwk' });
+
+    const cose = isoCBOR.encode(new Map<number, number | Uint8Array>([
+        [1, 2], // kty: EC2
+        [3, -7], // alg: ES256
+        [-1, 1], // crv: P-256
+        [-2, new Uint8Array(Buffer.from(jwk.x!, 'base64url'))],
+        [-3, new Uint8Array(Buffer.from(jwk.y!, 'base64url'))],
+    ]));
+
+    return { privateKey, cosePublicKey: Buffer.from(cose).toString('base64url') };
+}
+
+/**
+ * Build and sign the assertion an authenticator returns when it releases a passkey, so the
+ * whole verification path runs (origin, RP ID hash, challenge and signature).
+ */
+function signAssertion({ privateKey, rpId, origin, challenge }: { privateKey: crypto.KeyObject; rpId: string; origin: string; challenge: string }): WebauthnAuthenticationCredential {
+    const clientDataJSON = Buffer.from(JSON.stringify({ type: 'webauthn.get', challenge, origin, crossOrigin: false }));
+
+    // rpIdHash (32) + flags (user present + user verified) + signature counter
+    const authenticatorData = Buffer.concat([
+        crypto.createHash('sha256').update(rpId).digest(),
+        Buffer.from([0x05]),
+        Buffer.from([0x00, 0x00, 0x00, 0x01]),
+    ]);
+
+    const signature = crypto.sign('sha256', Buffer.concat([
+        authenticatorData,
+        crypto.createHash('sha256').update(clientDataJSON).digest(),
+    ]), privateKey);
+
+    return WebauthnAuthenticationCredential.create({
+        id: 'test-credential',
+        rawId: 'test-credential',
+        response: WebauthnAssertionResponseData.create({
+            clientDataJSON: clientDataJSON.toString('base64url'),
+            authenticatorData: authenticatorData.toString('base64url'),
+            signature: signature.toString('base64url'),
+        }),
+    });
+}
+
+function createStoredCredential(cosePublicKey: string): WebauthnCredential {
+    const credential = new WebauthnCredential();
+    credential.userId = 'test-user';
+    credential.credentialId = 'test-credential';
+    credential.publicKey = cosePublicKey;
+    credential.counter = 0;
+    credential.rpId = WebauthnHelper.getRpID();
+    return credential;
+}
+
+describe('WebauthnHelper', () => {
+    describe('expected origins', () => {
+        test('the web apps and the iOS app are accepted', () => {
+            const rpId = WebauthnHelper.getRpID();
+            const origins = WebauthnHelper.getExpectedOrigins(rpId);
+
+            expect(origins).toContain('https://' + rpId);
+            expect(origins).toContain('capacitor://' + rpId);
+        });
+
+        test('a configured Android certificate is accepted as an origin', () => {
+            TestUtils.setEnvironment('ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS', [FINGERPRINT]);
+
+            expect(WebauthnHelper.getExpectedOrigins(WebauthnHelper.getRpID())).toContain(FINGERPRINT_ORIGIN);
+        });
+
+        test('a fingerprint without separators is accepted too', () => {
+            TestUtils.setEnvironment('ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS', [FINGERPRINT.replace(/:/g, '').toLowerCase()]);
+
+            expect(WebauthnHelper.getExpectedOrigins(WebauthnHelper.getRpID())).toContain(FINGERPRINT_ORIGIN);
+        });
+
+        test('no Android origins are accepted when none are configured', () => {
+            expect(STAMHOOFD.ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS).toBeUndefined();
+
+            expect(WebauthnHelper.getExpectedOrigins(WebauthnHelper.getRpID()).filter(o => o.startsWith('android:'))).toHaveLength(0);
+        });
+
+        test('a fingerprint that is not a SHA-256 hash is rejected', () => {
+            TestUtils.setEnvironment('ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS', ['A0:7B:07']);
+
+            expect(() => WebauthnHelper.getExpectedOrigins(WebauthnHelper.getRpID())).toThrow('Invalid SHA-256 certificate fingerprint');
+        });
+    });
+
+    describe('verifying an assertion', () => {
+        test('a passkey used inside the Android app is accepted', async () => {
+            TestUtils.setEnvironment('ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS', [FINGERPRINT]);
+
+            const { privateKey, cosePublicKey } = createKeyPair();
+            const stored = createStoredCredential(cosePublicKey);
+            const challenge = crypto.randomBytes(32).toString('base64url');
+
+            const assertion = signAssertion({ privateKey, rpId: stored.rpId!, origin: FINGERPRINT_ORIGIN, challenge });
+
+            expect(await WebauthnHelper.verifyAuthentication(assertion, challenge, stored)).toBe(1);
+        });
+
+        test('a passkey used inside an app we did not sign is refused', async () => {
+            TestUtils.setEnvironment('ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS', [FINGERPRINT]);
+
+            const { privateKey, cosePublicKey } = createKeyPair();
+            const stored = createStoredCredential(cosePublicKey);
+            const challenge = crypto.randomBytes(32).toString('base64url');
+
+            const otherApp = 'android:apk-key-hash:' + crypto.randomBytes(32).toString('base64url');
+            const assertion = signAssertion({ privateKey, rpId: stored.rpId!, origin: otherApp, challenge });
+
+            expect(await WebauthnHelper.verifyAuthentication(assertion, challenge, stored)).toBeNull();
+        });
+
+        test('a passkey used in the browser stays accepted', async () => {
+            const { privateKey, cosePublicKey } = createKeyPair();
+            const stored = createStoredCredential(cosePublicKey);
+            const challenge = crypto.randomBytes(32).toString('base64url');
+
+            const assertion = signAssertion({ privateKey, rpId: stored.rpId!, origin: 'https://' + stored.rpId, challenge });
+
+            expect(await WebauthnHelper.verifyAuthentication(assertion, challenge, stored)).toBe(1);
+        });
+    });
+});

package/src/helpers/WebauthnHelper.ts

@@ -48,20 +48,46 @@ function getCredentialRpID(credential: WebauthnCredential): string {
     return credential.rpId ?? getRpID();
 }
 
+/**
+ * Convert a SHA-256 certificate fingerprint to the base64url encoding Android uses in its
+ * origin. Accepts the colon separated hexadecimal notation of assetlinks.json, with or
+ * without separators.
+ */
+function fingerprintToBase64URL(fingerprint: string): string {
+    const hex = fingerprint.replace(/[\s:-]/g, '');
+    if (!/^[0-9a-f]{64}$/i.test(hex)) {
+        throw new Error('Invalid SHA-256 certificate fingerprint in ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS: ' + fingerprint);
+    }
+    return Buffer.from(hex, 'hex').toString('base64url');
+}
+
+/**
+ * The origins the Android app presents a passkey from.
+ *
+ * Android reports the app that made the call instead of the address of the web view:
+ * `android:apk-key-hash:<base64url sha-256 of the signing certificate>`. The certificates
+ * are configured through ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS and are the same ones as
+ * in the assetlinks.json of the RP ID, which is what makes Android hand our passkeys to
+ * the app in the first place.
+ */
+function getAndroidOrigins(): string[] {
+    return (STAMHOOFD.ANDROID_PASSKEY_SHA256_CERT_FINGERPRINTS ?? []).map(fingerprint => 'android:apk-key-hash:' + fingerprintToBase64URL(fingerprint));
+}
+
 /**
  * The origins a passkey for `rpId` may be presented from.
  *
  * The web apps run on https. The Capacitor app serves its web view from the same host but
- * a custom scheme (see frontend/app/mobile/capacitor.config.json): iOS reports
- * `capacitor://<host>`, while Android is configured with the https scheme and so already
- * matches the first entry.
+ * a custom scheme (see frontend/app/mobile/capacitor.config.json), which iOS reports as
+ * `capacitor://<host>`; Android reports its own signature instead, see getAndroidOrigins.
  *
  * Widening the origin does not widen who can use these passkeys: the app only gets to see
- * them because it is listed in the associated domains (webcredentials) of the RP ID, which
- * the operating system verifies before it releases a credential to any app.
+ * them because it is listed in the associated domains (webcredentials / assetlinks.json)
+ * of the RP ID, which the operating system verifies before it releases a credential to any
+ * app.
  */
 function getExpectedOrigins(rpId: string): string[] {
-    return ['https://' + rpId, 'capacitor://' + rpId];
+    return ['https://' + rpId, 'capacitor://' + rpId, ...getAndroidOrigins()];
 }
 
 export const WebauthnHelper = {
@@ -107,13 +133,14 @@ export const WebauthnHelper = {
         };
 
         const rpId = getRpID();
+        const expectedOrigin = getExpectedOrigins(rpId);
 
         let verification: Awaited<ReturnType<typeof verifyRegistrationResponse>>;
         try {
             verification = await verifyRegistrationResponse({
                 response,
                 expectedChallenge,
-                expectedOrigin: getExpectedOrigins(rpId),
+                expectedOrigin,
                 expectedRPID: rpId,
                 requireUserVerification: false,
             });
@@ -181,13 +208,14 @@ export const WebauthnHelper = {
 
         // Verify against the RP ID this credential was created for, not the current one.
         const rpId = getCredentialRpID(storedCredential);
+        const expectedOrigin = getExpectedOrigins(rpId);
 
         let verification: Awaited<ReturnType<typeof verifyAuthenticationResponse>>;
         try {
             verification = await verifyAuthenticationResponse({
                 response,
                 expectedChallenge,
-                expectedOrigin: getExpectedOrigins(rpId),
+                expectedOrigin,
                 expectedRPID: rpId,
                 credential: {
                     id: storedCredential.credentialId,