nuxt-auth-utils 0.4.0 → 0.4.1

package/README.md

@@ -8,7 +8,8 @@
 Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
 - [Release Notes](/CHANGELOG.md)
-- [Demo](https://github.com/atinux/nuxt-todos-edge)
+- [Demo with OAuth](https://github.com/atinux/atidone)
+- [Demo with Passkeys](https://github.com/atinux/todo-passkeys)
 <!-- - [🏀 Online playground](https://stackblitz.com/github/your-org/nuxt-auth-utils?file=playground%2Fapp.vue) -->
 <!-- - [📖 &nbsp;Documentation](https://example.com) -->
 
@@ -16,7 +17,7 @@ Add Authentication to Nuxt applications with secured & sealed cookies sessions.
 
 - [Hybrid Rendering](#hybrid-rendering) support (SSR / CSR / SWR / Prerendering)
 - [20+ OAuth Providers](#supported-oauth-providers)
-- [Password hasing](#password-hashing)
+- [Password Hashing](#password-hashing)
 - [WebAuthn (passkey)](#webauthn-passkey)
 - [`useUserSession()` Vue composable](#vue-composable)
 - [Tree-shakable server utils](#server-utils)
@@ -422,7 +423,7 @@ export default defineWebAuthnAuthenticateEventHandler({
 ```
 
 > [!IMPORTANT]
-> By default, the webauthn event handlers will store the challenge in a short lived, encrypted session cookie. This is not recommended for applications that require strong security guarantees. On a secure connection (https) it is highly unlikely for this to cause problems. However, if the connection is not secure, there is a possibility of a man-in-the-middle attack. To prevent this, you should use a database or KV store to store the challenge instead. For this the `storeChallenge` and `getChallenge` functions are provided.
+> Webauthn uses challenges to prevent replay attacks. By default, this module does not make use if this feature. If you want to use challenges (**which is highly recommended**), the `storeChallenge` and `getChallenge` functions are provided. An attempt ID is created and sent with each autentication request. You can use this ID to store the challenge in a database or KV store as shown in the example below.
 
 > ```ts
 > export default defineWebAuthnAuthenticateEventHandler({

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "auth-utils",
   "configKey": "auth",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "builder": {
     "@nuxt/module-builder": "0.8.4",
     "unbuild": "2.0.0"

package/dist/runtime/server/lib/webauthn/authenticate.js

@@ -3,7 +3,6 @@ import { generateAuthenticationOptions, verifyAuthenticationResponse } from "@si
 import defu from "defu";
 import { getRandomValues } from "uncrypto";
 import { base64URLStringToBuffer, bufferToBase64URLString } from "@simplewebauthn/browser";
-import { storeChallengeAsSession, getChallengeFromSession } from "./utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnAuthenticateEventHandler({
   storeChallenge,
@@ -23,14 +22,16 @@ export function defineWebAuthnAuthenticateEventHandler({
     if (allowCredentials && body.userName) {
       _config.allowCredentials = await allowCredentials(event, body.userName);
     }
+    if (!storeChallenge) {
+      _config.challenge = "";
+    }
     try {
       if (!body.verify) {
         const options = await generateAuthenticationOptions(_config);
         const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
-        if (storeChallenge)
+        if (storeChallenge) {
           await storeChallenge(event, options.challenge, attemptId);
-        else
-          await storeChallengeAsSession(event, options.challenge, attemptId);
+        }
         return {
           requestOptions: options,
           attemptId
@@ -38,15 +39,14 @@ export function defineWebAuthnAuthenticateEventHandler({
       }
       if (!body.attemptId)
         throw createError({ statusCode: 400 });
-      let challenge;
-      if (getChallenge)
-        challenge = await getChallenge(event, body.attemptId);
-      else
-        challenge = await getChallengeFromSession(event, body.attemptId);
+      let expectedChallenge = "";
+      if (getChallenge) {
+        expectedChallenge = await getChallenge(event, body.attemptId);
+      }
       const credential = await getCredential(event, body.response.id);
       const verification = await verifyAuthenticationResponse({
         response: body.response,
-        expectedChallenge: challenge,
+        expectedChallenge,
         expectedOrigin: url.origin,
         expectedRPID: url.hostname,
         authenticator: {

package/dist/runtime/server/lib/webauthn/register.js

@@ -3,7 +3,6 @@ import { generateRegistrationOptions, verifyRegistrationResponse } from "@simple
 import defu from "defu";
 import { bufferToBase64URLString } from "@simplewebauthn/browser";
 import { getRandomValues } from "uncrypto";
-import { storeChallengeAsSession, getChallengeFromSession } from "./utils.js";
 import { useRuntimeConfig } from "#imports";
 export function defineWebAuthnRegisterEventHandler({
   storeChallenge,
@@ -34,14 +33,16 @@ export function defineWebAuthnRegisterEventHandler({
         userVerification: "preferred"
       }
     });
+    if (!storeChallenge) {
+      _config.challenge = "";
+    }
     try {
       if (!body.verify) {
         const options = await generateRegistrationOptions(_config);
         const attemptId = bufferToBase64URLString(getRandomValues(new Uint8Array(32)));
-        if (storeChallenge)
-          await storeChallenge?.(event, options.challenge, attemptId);
-        else
-          await storeChallengeAsSession(event, options.challenge, attemptId);
+        if (storeChallenge) {
+          await storeChallenge(event, options.challenge, attemptId);
+        }
         return {
           creationOptions: options,
           attemptId
@@ -53,11 +54,10 @@ export function defineWebAuthnRegisterEventHandler({
           statusCode: 400
         });
       }
-      let expectedChallenge;
-      if (getChallenge)
+      let expectedChallenge = "";
+      if (getChallenge) {
         expectedChallenge = await getChallenge(event, body.attemptId);
-      else
-        expectedChallenge = await getChallengeFromSession(event, body.attemptId);
+      }
       const verification = await verifyRegistrationResponse({
         response: body.response,
         expectedChallenge,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nuxt-auth-utils",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Add Authentication to Nuxt applications with secured & sealed cookies sessions.",
   "repository": "atinux/nuxt-auth-utils",
   "license": "MIT",

package/dist/runtime/server/lib/webauthn/utils.d.ts

@@ -1,3 +0,0 @@
-import { type H3Event } from 'h3';
-export declare function storeChallengeAsSession(event: H3Event, challenge: string, challengeId: string): Promise<void>;
-export declare function getChallengeFromSession(event: H3Event, challengeId: string): Promise<string>;

package/dist/runtime/server/lib/webauthn/utils.js

@@ -1,35 +0,0 @@
-import { useSession, createError } from "h3";
-import { useRuntimeConfig } from "#imports";
-function useChallengeSession(event) {
-  return useSession(event, {
-    name: "webauthn",
-    password: useRuntimeConfig(event).session.password,
-    cookie: {
-      httpOnly: true,
-      secure: true,
-      maxAge: 180
-      // 3 minutes
-    }
-  });
-}
-export async function storeChallengeAsSession(event, challenge, challengeId) {
-  const challengeSession = await useChallengeSession(event);
-  await challengeSession.update({
-    data: {
-      challenge,
-      challengeId
-    },
-    expires: Date.now() + 180 * 1e3
-    // 3 minutes
-  });
-}
-export async function getChallengeFromSession(event, challengeId) {
-  const challengeSession = await useChallengeSession(event);
-  const challenge = challengeSession.data;
-  await challengeSession.clear();
-  if (challenge.expires < Date.now())
-    throw createError({ statusCode: 400, message: "Challenge expired" });
-  if (challenge.data.challengeId !== challengeId)
-    throw createError({ statusCode: 400, message: "Challenge id mismatch" });
-  return challenge.data.challenge;
-}