nid-webauthn-emulator 0.2.16 → 0.2.17

package/dist/spec/webauthn/webauthn-model.spec.js

@@ -8,6 +8,62 @@ const node_test_1 = require("node:test");
 const encode_utils_1 = __importDefault(require("../../src/libs/encode-utils"));
 const webauthn_emulator_1 = require("../../src/webauthn/webauthn-emulator");
 const webauthn_model_1 = require("../../src/webauthn/webauthn-model");
+(0, node_test_1.describe)("RP ID validation", () => {
+    for (const [rpId, origin] of [
+        ["example.com", "https://example.com"],
+        ["example.com", "https://login.example.com"],
+        ["login.example.com", "https://nested.login.example.com"],
+        ["example.co.jp", "https://login.example.co.jp"],
+        ["localhost", "http://localhost:3000"],
+        ["localhost", "http://app.localhost:3000"],
+        ["EXAMPLE.COM", "https://LOGIN.EXAMPLE.COM:8443"],
+        ["example.com.", "https://login.example.com."],
+        ["bücher.de", "https://login.xn--bcher-kva.de"],
+    ]) {
+        (0, node_test_1.test)(`accepts ${origin} for ${rpId}`, () => {
+            strict_1.default.equal(new webauthn_model_1.RpId(rpId).validate(origin), true);
+        });
+    }
+    for (const [rpId, origin] of [
+        ["example.com", "https://other.com"],
+        ["example.com", "https://notexample.com"],
+        ["example.com", "https://example.com.evil.com"],
+        ["login.example.com", "https://evil-login.example.com"],
+        ["login.example.com", "https://other.example.com"],
+        ["login.example.com", "https://example.com"],
+        ["com", "https://example.com"],
+        ["127.0.0.1", "http://127.0.0.1:3000"],
+        ["[::1]", "http://[::1]:3000"],
+        ["0.0.1", "http://127.0.0.1"],
+        ["example.com", "https://[invalid]"],
+        ["example.com", ""],
+        ["", "https://example.com"],
+        ["invalid host", "https://example.com"],
+    ]) {
+        (0, node_test_1.test)(`rejects ${origin} for ${rpId}`, () => {
+            strict_1.default.equal(new webauthn_model_1.RpId(rpId).validate(origin), false);
+        });
+    }
+    (0, node_test_1.test)("accepts related hosts and their subdomains", () => {
+        const rpId = new webauthn_model_1.RpId("example.com");
+        const relatedOrigins = ["https://login.other.com"];
+        strict_1.default.equal(rpId.validate("https://login.other.com"), false);
+        strict_1.default.equal(rpId.validate("https://login.other.com", relatedOrigins), true);
+        strict_1.default.equal(rpId.validate("https://nested.login.other.com", relatedOrigins), true);
+        strict_1.default.equal(rpId.validate("https://evil-login.other.com", relatedOrigins), false);
+        strict_1.default.equal(rpId.validate("https://other.com", relatedOrigins), false);
+    });
+    (0, node_test_1.test)("preserves hostname-only matching for related origins", () => {
+        strict_1.default.equal(new webauthn_model_1.RpId("example.com").validate("http://other.com:3000", ["https://other.com"]), true);
+    });
+    (0, node_test_1.test)("ignores malformed related origins", () => {
+        strict_1.default.equal(new webauthn_model_1.RpId("example.com").validate("https://other.com", ["https://[invalid]", "https://other.com"]), true);
+    });
+    (0, node_test_1.test)("does not distinguish multi-label public suffixes from registrable domains", () => {
+        strict_1.default.equal(new webauthn_model_1.RpId("co.jp").validate("https://example.co.jp"), true);
+        strict_1.default.equal(new webauthn_model_1.RpId("co.uk").validate("https://example.co.uk"), true);
+    });
+});
 (0, node_test_1.describe)("WebAuthn Model Test", () => {
     const webauthnEmulator = new webauthn_emulator_1.WebAuthnEmulator();
     (0, node_test_1.test)("Attestation Object pack and unpack", async () => {

package/dist/src/webauthn/webauthn-model.d.ts

@@ -4,7 +4,7 @@ export declare class RpId {
     readonly value: string;
     constructor(value: string);
     get hash(): Uint8Array<ArrayBuffer>;
-    /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
+    /** Matches hostnames without Public Suffix List validation. */
     validate(origin: string, relatedOrigins?: string[]): boolean;
 }
 /** @see https://www.w3.org/TR/webauthn-3/#public-key-credential-source */

package/dist/src/webauthn/webauthn-model.js

@@ -13,7 +13,7 @@ exports.parsePublicKeyCredentialSourceFromJSON = parsePublicKeyCredentialSourceF
 exports.toFido2CreateOptions = toFido2CreateOptions;
 exports.toFido2RequestOptions = toFido2RequestOptions;
 const node_crypto_1 = require("node:crypto");
-const tldts_1 = require("tldts");
+const node_net_1 = require("node:net");
 const encode_utils_1 = __importDefault(require("../libs/encode-utils"));
 const cose_key_1 = require("./cose-key");
 class RpId {
@@ -24,26 +24,29 @@ class RpId {
     get hash() {
         return new Uint8Array((0, node_crypto_1.createHash)("sha256").update(this.value).digest());
     }
-    /** @see https://www.w3.org/TR/webauthn-3/#sctn-validating-origin */
+    /** Matches hostnames without Public Suffix List validation. */
     validate(origin, relatedOrigins = []) {
-        const parsedOrigin = (0, tldts_1.parse)(origin, { validHosts: ["localhost"] });
-        const expectedOrigins = [this.value, ...relatedOrigins];
-        // Check each origin using standard validation
-        for (const expectedOrigin of expectedOrigins) {
-            const parsedExpectedOrigin = (0, tldts_1.parse)(expectedOrigin, { validHosts: ["localhost"] });
-            const isValid = Boolean(parsedOrigin.domain &&
-                parsedOrigin.subdomain !== null &&
-                parsedExpectedOrigin.subdomain !== null &&
-                parsedOrigin.domain === parsedExpectedOrigin.domain &&
-                parsedOrigin.subdomain.endsWith(parsedExpectedOrigin.subdomain));
-            if (isValid) {
-                return true;
-            }
-        }
-        return false;
+        const hostname = parseHostname(origin);
+        if (!hostname)
+            return false;
+        return [this.value, ...relatedOrigins].some((expectedOrigin) => {
+            const expectedHostname = parseHostname(expectedOrigin);
+            return Boolean(expectedHostname && (hostname === expectedHostname || hostname.endsWith(`.${expectedHostname}`)));
+        });
     }
 }
 exports.RpId = RpId;
+function parseHostname(value) {
+    try {
+        const hostname = new URL(value.includes("://") ? value : `https://${value}`).hostname.replace(/\.$/, "");
+        if ((0, node_net_1.isIP)(hostname) || hostname.startsWith("["))
+            return undefined;
+        return hostname === "localhost" || hostname.includes(".") ? hostname : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 function packAttestationObject(attestationObject) {
     return encode_utils_1.default.encodeCbor({
         fmt: attestationObject.fmt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nid-webauthn-emulator",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "keywords": [
     "test",
     "e2e",
@@ -18,15 +18,12 @@
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
   "devDependencies": {
-    "@biomejs/biome": "2.5.14",
+    "@biomejs/biome": "2.6.3",
     "@simplewebauthn/server": "14.0.3",
     "@tsconfig/recommended": "1.0.13",
-    "@types/node": "26.6.2",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2"
   },
-  "dependencies": {
-    "tldts": "7.4.16"
-  },
   "scripts": {
     "check": "biome check .",
     "test": "pnpm build && node --test --test-concurrency=4 \"dist/spec/**/*.spec.js\"",